/* Header autogenerated by Brandon Falk's PDB Dumper * * Invocation: C:\projects\pdbdump_2\pdbdump.exe L:\symbolarchive\win8_spB_x86\wudfplatform.pdb\5AD00E8264CC440FAABEF1EDDA8A24A71\wudfplatform.pdb */ struct LIST_ENTRY64 { unsigned long long Flink; /* +0x0000 */ unsigned long long Blink; /* +0x0008 */ }; struct LIST_ENTRY32 { unsigned long Flink; /* +0x0000 */ unsigned long Blink; /* +0x0004 */ }; struct _GUID { unsigned long Data1; /* +0x0000 */ unsigned short Data2; /* +0x0004 */ unsigned short Data3; /* +0x0006 */ unsigned char Data4[8]; /* +0x0008 16 10 00 00 */ }; struct _KSYSTEM_TIME { unsigned long LowPart; /* +0x0000 */ long High1Time; /* +0x0004 */ long High2Time; /* +0x0008 */ }; enum _NT_PRODUCT_TYPE { NtProductWinNt = 1, NtProductLanManNt = 2, NtProductServer = 3 }; enum _ALTERNATIVE_ARCHITECTURE_TYPE { StandardDesign = 0, NEC98x86 = 1, EndAlternatives = 2 }; struct _KUSER_SHARED_DATA { unsigned long TickCountLowDeprecated; /* +0x0000 */ unsigned long TickCountMultiplier; /* +0x0004 */ unsigned char InterruptTime[12]; /* +0x0008 23 10 00 00 */ unsigned char SystemTime[12]; /* +0x0014 23 10 00 00 */ unsigned char TimeZoneBias[12]; /* +0x0020 23 10 00 00 */ unsigned short ImageNumberLow; /* +0x002c */ unsigned short ImageNumberHigh; /* +0x002e */ unsigned char NtSystemRoot[520]; /* +0x0030 2b 10 00 00 */ unsigned long MaxStackTraceDepth; /* +0x0238 */ unsigned long CryptoExponent; /* +0x023c */ unsigned long TimeZoneId; /* +0x0240 */ unsigned long LargePageMinimum; /* +0x0244 */ unsigned long AitSamplingValue; /* +0x0248 */ unsigned long AppCompatFlag; /* +0x024c */ unsigned long long RNGSeedVersion; /* +0x0250 */ unsigned long GlobalValidationRunlevel; /* +0x0258 */ unsigned char Reserved2[8]; /* +0x025c 2c 10 00 00 */ unsigned char NtProductType[4]; /* +0x0264 2e 10 00 00 */ unsigned char ProductTypeIsValid; /* +0x0268 */ unsigned char Reserved0[1]; /* +0x0269 2f 10 00 00 */ unsigned short NativeProcessorArchitecture; /* +0x026a */ unsigned long NtMajorVersion; /* +0x026c */ unsigned long NtMinorVersion; /* +0x0270 */ unsigned char ProcessorFeatures[64]; /* +0x0274 30 10 00 00 */ unsigned long Reserved1; /* +0x02b4 */ unsigned long Reserved3; /* +0x02b8 */ unsigned char TimeSlip[4]; /* +0x02bc 27 10 00 00 */ unsigned char AlternativeArchitecture[4]; /* +0x02c0 32 10 00 00 */ unsigned char AltArchitecturePad[4]; /* +0x02c4 33 10 00 00 */ unsigned char SystemExpirationDate[8]; /* +0x02c8 34 10 00 00 */ unsigned long SuiteMask; /* +0x02d0 */ unsigned char KdDebuggerEnabled; /* +0x02d4 */ unsigned char MitigationPolicies; /* +0x02d5 */ /* unsigned char NXSupportPolicy[0]; +0x02d5 35 10 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x02d5 36 10 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x02d5 37 10 00 00 */ unsigned char Reserved[1]; /* +0x02d5 38 10 00 00 */ unsigned char Reserved6[2]; /* +0x02d6 39 10 00 00 */ unsigned char ActiveConsoleId[4]; /* +0x02d8 27 10 00 00 */ unsigned char DismountCount[4]; /* +0x02dc 27 10 00 00 */ unsigned long ComPlusPackage; /* +0x02e0 */ unsigned long LastSystemRITEventTickCount; /* +0x02e4 */ unsigned long NumberOfPhysicalPages; /* +0x02e8 */ unsigned char SafeBootMode; /* +0x02ec */ unsigned char Reserved12[3]; /* +0x02ed 3a 10 00 00 */ unsigned long SharedDataFlags; /* +0x02f0 */ /* unsigned char DbgErrorPortPresent[0]; +0x02f0 3b 10 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x02f0 3c 10 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x02f0 3d 10 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x02f0 3e 10 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x02f0 3f 10 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x02f0 40 10 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x02f0 41 10 00 00 */ unsigned char SpareBits[4]; /* +0x02f0 42 10 00 00 */ unsigned char DataFlagsPad[4]; /* +0x02f4 33 10 00 00 */ unsigned long long TestRetInstruction; /* +0x02f8 */ unsigned long Reserved9; /* +0x0300 */ unsigned long Reserved10; /* +0x0304 */ unsigned char SystemCallPad[24]; /* +0x0308 43 10 00 00 */ /* unsigned char TickCount[0]; +0x0320 23 10 00 00 */ /* unsigned char TickCountQuad[0]; +0x0320 44 10 00 00 */ unsigned char ReservedTickCountOverlay[12]; /* +0x0320 45 10 00 00 */ unsigned char TickCountPad[4]; /* +0x032c 33 10 00 00 */ unsigned long Cookie; /* +0x0330 */ unsigned char CookiePad[4]; /* +0x0334 33 10 00 00 */ long long ConsoleSessionForegroundProcessId; /* +0x0338 */ unsigned char TimeUpdateSequence[8]; /* +0x0340 44 10 00 00 */ unsigned long long LastTimeUpdateQpcValue; /* +0x0348 */ unsigned long long LastInterruptTimeUpdateQpcValue; /* +0x0350 */ unsigned long long QpcTimeIncrement; /* +0x0358 */ unsigned long QpcTimeIncrement32; /* +0x0360 */ unsigned char Reserved8[28]; /* +0x0364 46 10 00 00 */ unsigned char UserModeGlobalLogger[32]; /* +0x0380 47 10 00 00 */ unsigned long ImageFileExecutionOptions; /* +0x03a0 */ unsigned long LangGenerationCount; /* +0x03a4 */ unsigned char InterruptTimeBias[8]; /* +0x03a8 44 10 00 00 */ unsigned char TscQpcBias[8]; /* +0x03b0 44 10 00 00 */ unsigned char ActiveProcessorCount[4]; /* +0x03b8 27 10 00 00 */ unsigned char ActiveGroupCount[1]; /* +0x03bc 48 10 00 00 */ unsigned char QpcTimeIncrementShift; /* +0x03bd */ unsigned short TscQpcData; /* +0x03be */ unsigned char TscQpcEnabled[1]; /* +0x03be 48 10 00 00 */ unsigned char TscQpcShift; /* +0x03bf */ unsigned char XState[528]; /* +0x03c0 49 10 00 00 */ }; struct _ULARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ unsigned long HighPart; /* +0x0004 */ }; struct _LARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ long HighPart; /* +0x0004 */ }; enum _TP_CALLBACK_PRIORITY { TP_CALLBACK_PRIORITY_HIGH = 0, TP_CALLBACK_PRIORITY_NORMAL = 1, TP_CALLBACK_PRIORITY_LOW = 2, TP_CALLBACK_PRIORITY_INVALID = 3, TP_CALLBACK_PRIORITY_COUNT = 3 }; struct _TP_CALLBACK_ENVIRON_V3 { unsigned long Version; /* +0x0000 */ unsigned char Pool[4]; /* +0x0004 59 10 00 00 */ unsigned char CleanupGroup[4]; /* +0x0008 5b 10 00 00 */ unsigned char CleanupGroupCancelCallback[4]; /* +0x000c 5e 10 00 00 */ void *RaceDll; /* +0x0010 */ unsigned char ActivationContext[4]; /* +0x0014 60 10 00 00 */ unsigned char FinalizationCallback[16]; /* +0x0018 65 10 00 00 */ }; struct _TP_CALLBACK_ENVIRON_V3:: { unsigned long Flags; /* +0x0000 */ }; struct _TP_CALLBACK_ENVIRON_V3:::: { /* unsigned char LongFunction[0]; +0x0000 3b 10 00 00 */ /* unsigned char Persistent[0]; +0x0000 3c 10 00 00 */ unsigned char Private[4]; /* +0x0000 78 10 00 00 */ }; struct _TP_TASK { unsigned char Callbacks[4]; /* +0x0000 7f 10 00 00 */ unsigned long NumaNode; /* +0x0004 */ unsigned char IdealProcessor; /* +0x0008 */ unsigned char ListEntry[8]; /* +0x000c 80 10 00 00 */ }; struct _TP_TASK_CALLBACKS { unsigned char ExecuteCallback[4]; /* +0x0000 86 10 00 00 */ unsigned char Unposted[4]; /* +0x0004 89 10 00 00 */ }; struct _TEB { unsigned char NtTib[28]; /* +0x0000 92 10 00 00 */ void *EnvironmentPointer; /* +0x001c */ unsigned char ClientId[8]; /* +0x0020 93 10 00 00 */ void *ActiveRpcHandle; /* +0x0028 */ void *ThreadLocalStoragePointer; /* +0x002c */ unsigned char ProcessEnvironmentBlock[4]; /* +0x0030 95 10 00 00 */ unsigned long LastErrorValue; /* +0x0034 */ unsigned long CountOfOwnedCriticalSections; /* +0x0038 */ void *CsrClientThread; /* +0x003c */ void *Win32ThreadInfo; /* +0x0040 */ unsigned char User32Reserved[104]; /* +0x0044 96 10 00 00 */ unsigned char UserReserved[20]; /* +0x00ac 97 10 00 00 */ void *WOW32Reserved; /* +0x00c0 */ unsigned long CurrentLocale; /* +0x00c4 */ unsigned long FpSoftwareStatusRegister; /* +0x00c8 */ unsigned char SystemReserved1[216]; /* +0x00cc 98 10 00 00 */ long ExceptionCode; /* +0x01a4 */ unsigned char ActivationContextStackPointer[4]; /* +0x01a8 9a 10 00 00 */ unsigned char SpareBytes[36]; /* +0x01ac 9b 10 00 00 */ unsigned long TxFsContext; /* +0x01d0 */ unsigned char GdiTebBatch[1248]; /* +0x01d4 9c 10 00 00 */ unsigned char RealClientId[8]; /* +0x06b4 93 10 00 00 */ void *GdiCachedProcessHandle; /* +0x06bc */ unsigned long GdiClientPID; /* +0x06c0 */ unsigned long GdiClientTID; /* +0x06c4 */ void *GdiThreadLocalInfo; /* +0x06c8 */ unsigned char Win32ClientInfo[248]; /* +0x06cc 9d 10 00 00 */ unsigned char glDispatchTable[932]; /* +0x07c4 9e 10 00 00 */ unsigned char glReserved1[116]; /* +0x0b68 9f 10 00 00 */ void *glReserved2; /* +0x0bdc */ void *glSectionInfo; /* +0x0be0 */ void *glSection; /* +0x0be4 */ void *glTable; /* +0x0be8 */ void *glCurrentRC; /* +0x0bec */ void *glContext; /* +0x0bf0 */ unsigned long LastStatusValue; /* +0x0bf4 */ unsigned char StaticUnicodeString[8]; /* +0x0bf8 a0 10 00 00 */ unsigned char StaticUnicodeBuffer[524]; /* +0x0c00 a1 10 00 00 */ void *DeallocationStack; /* +0x0e0c */ unsigned char TlsSlots[256]; /* +0x0e10 a2 10 00 00 */ unsigned char TlsLinks[8]; /* +0x0f10 80 10 00 00 */ void *Vdm; /* +0x0f18 */ void *ReservedForNtRpc; /* +0x0f1c */ unsigned char DbgSsReserved[8]; /* +0x0f20 a3 10 00 00 */ unsigned long HardErrorMode; /* +0x0f28 */ unsigned char Instrumentation[36]; /* +0x0f2c a4 10 00 00 */ unsigned char ActivityId[16]; /* +0x0f50 13 10 00 00 */ void *SubProcessTag; /* +0x0f60 */ void *EtwLocalData; /* +0x0f64 */ void *EtwTraceData; /* +0x0f68 */ void *WinSockData; /* +0x0f6c */ unsigned long GdiBatchCount; /* +0x0f70 */ /* unsigned char CurrentIdealProcessor[0]; +0x0f74 a5 10 00 00 */ unsigned long IdealProcessorValue; /* +0x0f74 */ unsigned char ReservedPad0; /* +0x0f74 */ unsigned char ReservedPad1; /* +0x0f75 */ unsigned char ReservedPad2; /* +0x0f76 */ unsigned char IdealProcessor; /* +0x0f77 */ unsigned long GuaranteedStackBytes; /* +0x0f78 */ void *ReservedForPerf; /* +0x0f7c */ void *ReservedForOle; /* +0x0f80 */ unsigned long WaitingOnLoaderLock; /* +0x0f84 */ void *SavedPriorityState; /* +0x0f88 */ unsigned long ReservedForCodeCoverage; /* +0x0f8c */ void *ThreadPoolData; /* +0x0f90 */ unsigned char TlsExpansionSlots[4]; /* +0x0f94 21 10 00 00 */ unsigned long MuiGeneration; /* +0x0f98 */ unsigned long IsImpersonating; /* +0x0f9c */ void *NlsCache; /* +0x0fa0 */ void *pShimData; /* +0x0fa4 */ unsigned short HeapVirtualAffinity; /* +0x0fa8 */ unsigned short LowFragHeapDataSlot; /* +0x0faa */ void *CurrentTransactionHandle; /* +0x0fac */ unsigned char ActiveFrame[4]; /* +0x0fb0 a7 10 00 00 */ void *FlsData; /* +0x0fb4 */ void *PreferredLanguages; /* +0x0fb8 */ void *UserPrefLanguages; /* +0x0fbc */ void *MergedPrefLanguages; /* +0x0fc0 */ unsigned long MuiImpersonation; /* +0x0fc4 */ /* unsigned char CrossTebFlags[0]; +0x0fc8 a8 10 00 00 */ unsigned char SpareCrossTebBits[2]; /* +0x0fc8 a9 10 00 00 */ unsigned short SameTebFlags; /* +0x0fca */ /* unsigned char SafeThunkCall[0]; +0x0fca aa 10 00 00 */ /* unsigned char InDebugPrint[0]; +0x0fca ab 10 00 00 */ /* unsigned char HasFiberData[0]; +0x0fca ac 10 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x0fca ad 10 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x0fca ae 10 00 00 */ /* unsigned char RanProcessInit[0]; +0x0fca af 10 00 00 */ /* unsigned char ClonedThread[0]; +0x0fca b0 10 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x0fca b1 10 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x0fca b2 10 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x0fca b3 10 00 00 */ /* unsigned char InitialThread[0]; +0x0fca b4 10 00 00 */ /* unsigned char SessionAware[0]; +0x0fca b5 10 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x0fca b6 10 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x0fca b7 10 00 00 */ void *TxnScopeEnterCallback; /* +0x0fcc */ void *TxnScopeExitCallback; /* +0x0fd0 */ void *TxnScopeContext; /* +0x0fd4 */ unsigned long LockCount; /* +0x0fd8 */ unsigned long SpareUlong0; /* +0x0fdc */ void *ResourceRetValue; /* +0x0fe0 */ void *ReservedForWdf; /* +0x0fe4 */ }; struct _LIST_ENTRY { unsigned char Flink[4]; /* +0x0000 ba 10 00 00 */ unsigned char Blink[4]; /* +0x0004 ba 10 00 00 */ }; struct _SINGLE_LIST_ENTRY { unsigned char Next[4]; /* +0x0000 c9 10 00 00 */ }; struct _RTL_SPLAY_LINKS { unsigned char Parent[4]; /* +0x0000 ce 10 00 00 */ unsigned char LeftChild[4]; /* +0x0004 ce 10 00 00 */ unsigned char RightChild[4]; /* +0x0008 ce 10 00 00 */ }; struct _RTL_DYNAMIC_HASH_TABLE_CONTEXT { unsigned char ChainHead[4]; /* +0x0000 ba 10 00 00 */ unsigned char PrevLinkage[4]; /* +0x0004 ba 10 00 00 */ unsigned long Signature; /* +0x0008 */ }; struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR { unsigned char HashEntry[12]; /* +0x0000 d8 10 00 00 */ unsigned char ChainHead[4]; /* +0x000c ba 10 00 00 */ unsigned long BucketIndex; /* +0x0010 */ }; struct _RTL_DYNAMIC_HASH_TABLE_ENTRY { unsigned char Linkage[8]; /* +0x0000 80 10 00 00 */ unsigned long Signature; /* +0x0008 */ }; struct _RTL_DYNAMIC_HASH_TABLE { unsigned long Flags; /* +0x0000 */ unsigned long Shift; /* +0x0004 */ unsigned long TableSize; /* +0x0008 */ unsigned long Pivot; /* +0x000c */ unsigned long DivisorMask; /* +0x0010 */ unsigned long NumEntries; /* +0x0014 */ unsigned long NonEmptyBuckets; /* +0x0018 */ unsigned long NumEnumerators; /* +0x001c */ void *Directory; /* +0x0020 */ }; struct _UNICODE_STRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ unsigned char Buffer[4]; /* +0x0004 71 04 00 00 */ }; struct _STRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ char *Buffer; /* +0x0004 */ }; struct _LARGE_INTEGER:: { unsigned long LowPart; /* +0x0000 */ long HighPart; /* +0x0004 */ }; struct _IMAGE_NT_HEADERS { unsigned long Signature; /* +0x0000 */ unsigned char FileHeader[20]; /* +0x0004 f6 10 00 00 */ unsigned char OptionalHeader[224]; /* +0x0018 f7 10 00 00 */ }; struct _IMAGE_DOS_HEADER { unsigned short e_magic; /* +0x0000 */ unsigned short e_cblp; /* +0x0002 */ unsigned short e_cp; /* +0x0004 */ unsigned short e_crlc; /* +0x0006 */ unsigned short e_cparhdr; /* +0x0008 */ unsigned short e_minalloc; /* +0x000a */ unsigned short e_maxalloc; /* +0x000c */ unsigned short e_ss; /* +0x000e */ unsigned short e_sp; /* +0x0010 */ unsigned short e_csum; /* +0x0012 */ unsigned short e_ip; /* +0x0014 */ unsigned short e_cs; /* +0x0016 */ unsigned short e_lfarlc; /* +0x0018 */ unsigned short e_ovno; /* +0x001a */ unsigned char e_res[8]; /* +0x001c fc 10 00 00 */ unsigned short e_oemid; /* +0x0024 */ unsigned short e_oeminfo; /* +0x0026 */ unsigned char e_res2[20]; /* +0x0028 fd 10 00 00 */ long e_lfanew; /* +0x003c */ }; struct _RTL_BALANCED_NODE { /* unsigned char Children[0]; +0x0000 05 11 00 00 */ unsigned char Left[4]; /* +0x0000 04 11 00 00 */ unsigned char Right[4]; /* +0x0004 04 11 00 00 */ /* unsigned char Red[0]; +0x0008 06 11 00 00 */ /* unsigned char Balance[0]; +0x0008 35 10 00 00 */ unsigned long ParentValue; /* +0x0008 */ }; struct _RTL_RB_TREE { unsigned char Root[4]; /* +0x0000 04 11 00 00 */ unsigned char Min[4]; /* +0x0004 04 11 00 00 */ }; struct _RTL_AVL_TREE { unsigned char Root[4]; /* +0x0000 04 11 00 00 */ }; struct _ldiv_t { long quot; /* +0x0000 */ long rem; /* +0x0004 */ }; struct _iobuf { char *_ptr; /* +0x0000 */ unsigned char _cnt[4]; /* +0x0004 74 00 00 00 */ char *_base; /* +0x0008 */ unsigned char _flag[4]; /* +0x000c 74 00 00 00 */ unsigned char _file[4]; /* +0x0010 74 00 00 00 */ unsigned char _charbuf[4]; /* +0x0014 74 00 00 00 */ unsigned char _bufsiz[4]; /* +0x0018 74 00 00 00 */ char *_tmpfname; /* +0x001c */ }; struct localeinfo_struct { unsigned char locinfo[4]; /* +0x0000 3b 11 00 00 */ unsigned char mbcinfo[4]; /* +0x0004 3d 11 00 00 */ }; enum tagAR_STATE { AR_ENABLED = 0, AR_DISABLED = 1, AR_SUPPRESSED = 2, AR_REMOTESESSION = 4, AR_MULTIMON = 8, AR_NOSENSOR = 16, AR_NOT_SUPPORTED = 32 }; struct _EVENT_DATA_DESCRIPTOR { unsigned long long Ptr; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ }; struct _EVENT_DESCRIPTOR { unsigned short Id; /* +0x0000 */ unsigned char Version; /* +0x0002 */ unsigned char Channel; /* +0x0003 */ unsigned char Level; /* +0x0004 */ unsigned char Opcode; /* +0x0005 */ unsigned short Task; /* +0x0006 */ unsigned long long Keyword; /* +0x0008 */ }; enum _DEVICE_POWER_STATE { PowerDeviceUnspecified = 0, PowerDeviceD0 = 1, PowerDeviceD1 = 2, PowerDeviceD2 = 3, PowerDeviceD3 = 4, PowerDeviceMaximum = 5 }; enum _DEVICE_WAKE_DEPTH { DeviceWakeDepthNotWakeable = 0, DeviceWakeDepthD0 = 1, DeviceWakeDepthD1 = 2, DeviceWakeDepthD2 = 3, DeviceWakeDepthD3hot = 4, DeviceWakeDepthD3cold = 5, DeviceWakeDepthMaximum = 6 }; struct _WORK_QUEUE_ITEM { unsigned char List[8]; /* +0x0000 80 10 00 00 */ unsigned char WorkerRoutine[4]; /* +0x0008 01 12 00 00 */ void *Parameter; /* +0x000c */ }; enum _POWER_STATE_TYPE { SystemPowerState = 0, DevicePowerState = 1 }; enum _DEVICE_RELATION_TYPE { BusRelations = 0, EjectionRelations = 1, PowerRelations = 2, RemovalRelations = 3, TargetDeviceRelation = 4, SingleBusRelations = 5, TransportRelations = 6 }; struct MxDeviceObject { unsigned char m_DeviceObject[4]; /* +0x0000 08 12 00 00 */ }; struct HINSTANCE__ { unsigned char unused[4]; /* +0x0000 74 00 00 00 */ }; struct _OBJECT_ATTRIBUTES { unsigned long Length; /* +0x0000 */ void *RootDirectory; /* +0x0004 */ unsigned char ObjectName[4]; /* +0x0008 e3 10 00 00 */ unsigned long Attributes; /* +0x000c */ void *SecurityDescriptor; /* +0x0010 */ void *SecurityQualityOfService; /* +0x0014 */ }; struct MxLockNoDynam { unsigned char m_Lock[32]; /* +0x0000 3c 12 00 00 */ }; struct MdLock { unsigned char Lock[24]; /* +0x0000 48 12 00 00 */ unsigned char Initialized[4]; /* +0x0018 30 00 00 00 */ unsigned long OwnerThreadId; /* +0x001c */ }; struct _RTL_CRITICAL_SECTION { unsigned char DebugInfo[4]; /* +0x0000 5a 12 00 00 */ long LockCount; /* +0x0004 */ long RecursionCount; /* +0x0008 */ void *OwningThread; /* +0x000c */ void *LockSemaphore; /* +0x0010 */ unsigned long SpinCount; /* +0x0014 */ }; struct MxPagedLockNoDynam { unsigned char m_Lock[32]; /* +0x0000 68 12 00 00 */ }; enum _EVENT_TYPE { NotificationEvent = 0, SynchronizationEvent = 1 }; enum _KWAIT_REASON { Executive = 0, FreePage = 1, PageIn = 2, PoolAllocation = 3, DelayExecution = 4, Suspended = 5, UserRequest = 6, WrExecutive = 7, WrFreePage = 8, WrPageIn = 9, WrPoolAllocation = 10, WrDelayExecution = 11, WrSuspended = 12, WrUserRequest = 13, WrEventPair = 14, WrQueue = 15, WrLpcReceive = 16, WrLpcReply = 17, WrVirtualMemory = 18, WrPageOut = 19, WrRendezvous = 20, Spare2 = 21, Spare3 = 22, Spare4 = 23, Spare5 = 24, WrCalloutStack = 25, WrKernel = 26, WrResource = 27, WrPushLock = 28, WrMutex = 29, WrQuantumEnd = 30, WrDispatchInt = 31, WrPreempted = 32, WrYieldExecution = 33, WrFastMutex = 34, WrGuardedMutex = 35, WrRundown = 36, MaximumWaitReason = 37 }; struct MxEvent { unsigned char m_Event[4]; /* +0x0000 79 12 00 00 */ }; struct MdEvent { void *Event; /* +0x0000 */ }; struct _SECURITY_ATTRIBUTES { unsigned long nLength; /* +0x0000 */ void *lpSecurityDescriptor; /* +0x0004 */ unsigned char bInheritHandle[4]; /* +0x0008 74 00 00 00 */ }; enum _POOL_TYPE { NonPagedPool = 0, PagedPool = 1, NonPagedPoolMustSucceed = 2, DontUseThisType = 3, NonPagedPoolCacheAligned = 4, PagedPoolCacheAligned = 5, NonPagedPoolCacheAlignedMustS = 6, MaxPoolType = 7, NonPagedPoolSession = 32, PagedPoolSession = 33, NonPagedPoolMustSucceedSession = 34, DontUseThisTypeSession = 35, NonPagedPoolCacheAlignedSession = 36, PagedPoolCacheAlignedSession = 37, NonPagedPoolCacheAlignedMustSSession = 38, NonPagedPoolNx = 512, NonPagedPoolNxCacheAligned = 516 }; struct _MdTimerWin5 { unsigned char m_TimerCallback[4]; /* +0x0000 a5 12 00 00 */ void *m_TimerContext; /* +0x0004 */ long m_Period; /* +0x0008 */ unsigned char m_Lock[24]; /* +0x000c 48 12 00 00 */ unsigned char m_LockInitialized[4]; /* +0x0024 74 00 00 00 */ void *m_TimerHandle; /* +0x0028 */ void *m_WaitHandle; /* +0x002c */ unsigned char m_CallbackStartedRunning[4]; /* +0x0030 74 00 00 00 */ }; struct _MdTimerWin6Plus { unsigned char m_TimerCallback[4]; /* +0x0000 a5 12 00 00 */ void *m_TimerContext; /* +0x0004 */ long m_Period; /* +0x0008 */ unsigned char m_TP[32]; /* +0x000c c6 12 00 00 */ unsigned char m_TimerHandle[4]; /* +0x002c c8 12 00 00 */ unsigned char m_WorkObject[4]; /* +0x0030 ca 12 00 00 */ unsigned char m_CallbackStartedRunning[4]; /* +0x0034 74 00 00 00 */ }; struct _MXTIMER_THREADPOOL_FUNC { unsigned char hKernel32[4]; /* +0x0000 28 12 00 00 */ unsigned char pfnCreateTpTimer[4]; /* +0x0004 e0 12 00 00 */ unsigned char pfnSetTpTimer[4]; /* +0x0008 e5 12 00 00 */ unsigned char pfnWaitForTpTimerCallbacks[4]; /* +0x000c e8 12 00 00 */ unsigned char pfnCreateTpWork[4]; /* +0x0010 ed 12 00 00 */ unsigned char pfnSubmitTpWork[4]; /* +0x0014 f0 12 00 00 */ unsigned char pfnCloseTpTimer[4]; /* +0x0018 f3 12 00 00 */ unsigned char pfnCloseTpWork[4]; /* +0x001c f0 12 00 00 */ }; struct _FILETIME { unsigned long dwLowDateTime; /* +0x0000 */ unsigned long dwHighDateTime; /* +0x0004 */ }; struct _MdTimer { unsigned char m_RunningOnWin6Plus[4]; /* +0x0000 74 00 00 00 */ unsigned char m_Win5Timer[52]; /* +0x0004 a1 12 00 00 */ unsigned char m_Win6PlusTimer[56]; /* +0x0038 c4 12 00 00 */ }; struct _OSVERSIONINFOW { unsigned long dwOSVersionInfoSize; /* +0x0000 */ unsigned long dwMajorVersion; /* +0x0004 */ unsigned long dwMinorVersion; /* +0x0008 */ unsigned long dwBuildNumber; /* +0x000c */ unsigned long dwPlatformId; /* +0x0010 */ unsigned char szCSDVersion[256]; /* +0x0014 19 13 00 00 */ }; struct MxTimer { unsigned char m_Timer[112]; /* +0x0000 08 13 00 00 */ }; struct MxWorkItem { unsigned char m_WorkItem[4]; /* +0x0000 2c 13 00 00 */ }; struct UmWorkItem { unsigned char DeviceObject[4]; /* +0x0000 08 12 00 00 */ unsigned char WaitBlock[4]; /* +0x0004 2f 13 00 00 */ void *WorkItemEvent; /* +0x0008 */ unsigned char Callback[4]; /* +0x000c 36 13 00 00 */ void *Context; /* +0x0010 */ }; enum WudfProblem { WudfProblem_None = 0, WudfProblem_Cancelled = 1, WudfProblem_SendFailure = 2, WudfProblem_Timeout = 3, WudfProblem_InvalidRequest = 4, WudfProblem_InvalidReply = 5, WudfProblem_FailedCriticalOperation = 6, WudfProblem_FailedToExit = 7, WudfProblem_Disconnect = 8, WudfProblem_LeakingHandle = 9, WudfProblem_InvalidInterruptState = 10, WudfProblem_IsrTimedOut = 11, WudfProblem_Max = 12 }; enum WdfComponentType { WdfComponentInvalid = 0, WdfComponentPlatform = 1, WdfComponentReflector = 2, WdfComponentDriverManager = 3, WdfComponentHost = 4, WdfComponentFramework = 5, WdfComponentTest = 6, WdfComponentMax = 7 }; enum _WDF_HOST_EXIT_CODE { WdfHostExit_StillActive = 259, /* WdfHostExit_CodeUnknown = Unavail */ }; enum WudfOperationType { WudfOperation_Invalid = 0, WudfOperation_Init = 1, WudfOperation_HostShutdown = 2, WudfOperation_Pnp = 3, WudfOperation_Cleanup = 4, WudfOperation_Close = 5, WudfOperation_Cancel = 6, WudfOperation_IO = 7, WudfOperation_Interrupt = 8, WudfOperation_Other = 9, WudfOperation_Max = 10 }; enum WdfDeviceStartStateType { WudfDeviceStartState_Unknown = 0, WudfDeviceStartState_NotStarted = 1, WudfDeviceStartState_Started = 2, WudfDeviceStartState_Removed = 3 }; struct WUDF_PROBLEM { unsigned char ProblemCode[4]; /* +0x0000 59 13 00 00 */ unsigned char Detector[4]; /* +0x0004 5b 13 00 00 */ unsigned char ExitCode[4]; /* +0x0008 5d 13 00 00 */ unsigned char Operation[4]; /* +0x000c 5f 13 00 00 */ unsigned long Message; /* +0x0010 */ unsigned long Status; /* +0x0014 */ unsigned char DeviceStarted[4]; /* +0x0018 61 13 00 00 */ }; struct tagPROPVARIANT { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ char cVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char hVal[0]; +0x0008 34 10 00 00 */ /* unsigned char uhVal[0]; +0x0008 4c 10 00 00 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 7a 13 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char filetime[0]; +0x0008 e1 12 00 00 */ /* unsigned char puuid[0]; +0x0008 7b 13 00 00 */ /* unsigned char pclipdata[0]; +0x0008 7d 13 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 04 00 00 */ /* unsigned char bstrblobVal[0]; +0x0008 7e 13 00 00 */ /* unsigned char blob[0]; +0x0008 7f 13 00 00 */ char *pszVal; /* +0x0008 */ /* unsigned char pwszVal[0]; +0x0008 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0008 81 13 00 00 */ /* unsigned char pdispVal[0]; +0x0008 83 13 00 00 */ /* unsigned char pStream[0]; +0x0008 85 13 00 00 */ /* unsigned char pStorage[0]; +0x0008 87 13 00 00 */ /* unsigned char pVersionedStream[0]; +0x0008 89 13 00 00 */ /* unsigned char parray[0]; +0x0008 8b 13 00 00 */ /* unsigned char cac[0]; +0x0008 8c 13 00 00 */ /* unsigned char caub[0]; +0x0008 8d 13 00 00 */ /* unsigned char cai[0]; +0x0008 8e 13 00 00 */ /* unsigned char caui[0]; +0x0008 8f 13 00 00 */ /* unsigned char cal[0]; +0x0008 90 13 00 00 */ /* unsigned char caul[0]; +0x0008 91 13 00 00 */ /* unsigned char cah[0]; +0x0008 92 13 00 00 */ /* unsigned char cauh[0]; +0x0008 93 13 00 00 */ /* unsigned char caflt[0]; +0x0008 94 13 00 00 */ /* unsigned char cadbl[0]; +0x0008 95 13 00 00 */ /* unsigned char cabool[0]; +0x0008 96 13 00 00 */ /* unsigned char cascode[0]; +0x0008 97 13 00 00 */ /* unsigned char cacy[0]; +0x0008 98 13 00 00 */ /* unsigned char cadate[0]; +0x0008 99 13 00 00 */ /* unsigned char cafiletime[0]; +0x0008 9a 13 00 00 */ /* unsigned char cauuid[0]; +0x0008 9b 13 00 00 */ /* unsigned char caclipdata[0]; +0x0008 9c 13 00 00 */ /* unsigned char cabstr[0]; +0x0008 9d 13 00 00 */ /* unsigned char cabstrblob[0]; +0x0008 9e 13 00 00 */ /* unsigned char calpstr[0]; +0x0008 9f 13 00 00 */ /* unsigned char calpwstr[0]; +0x0008 a0 13 00 00 */ /* unsigned char capropvar[0]; +0x0008 a1 13 00 00 */ char *pcVal; /* +0x0008 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ long *plVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 04 00 00 */ /* unsigned char pfltVal[0]; +0x0008 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 04 00 00 */ short *pboolVal; /* +0x0008 */ /* unsigned char pdecVal[0]; +0x0008 a3 13 00 00 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 a4 13 00 00 */ /* unsigned char pdate[0]; +0x0008 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e6 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 a5 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 a6 13 00 00 */ /* unsigned char pparray[0]; +0x0008 a7 13 00 00 */ /* unsigned char pvarVal[-8]; +0x0008 79 13 00 00 */ unsigned char decVal[16]; /* +0x0000 a2 13 00 00 */ }; struct tagVARIANT { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ long long llVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 7a 13 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0008 81 13 00 00 */ /* unsigned char pdispVal[0]; +0x0008 83 13 00 00 */ /* unsigned char parray[0]; +0x0008 8b 13 00 00 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ long *plVal; /* +0x0008 */ long long *pllVal; /* +0x0008 */ /* unsigned char pfltVal[0]; +0x0008 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 04 00 00 */ short *pboolVal; /* +0x0008 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 a4 13 00 00 */ /* unsigned char pdate[0]; +0x0008 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e6 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 a5 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 a6 13 00 00 */ /* unsigned char pparray[0]; +0x0008 a7 13 00 00 */ /* unsigned char pvarVal[0]; +0x0008 ab 13 00 00 */ void *byref; /* +0x0008 */ char cVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ unsigned long long ullVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char pdecVal[0]; +0x0008 a3 13 00 00 */ char *pcVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ unsigned long long *pullVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 04 00 00 */ void *pvRecord; /* +0x0008 */ /* unsigned char pRecInfo[-12]; +0x000c af 13 00 00 */ unsigned char decVal[16]; /* +0x0000 a2 13 00 00 */ }; enum ADDRESS_MODE { AddrMode1616 = 0, AddrMode1632 = 1, AddrModeReal = 2, AddrModeFlat = 3 }; struct _tagADDRESS64 { unsigned long long Offset; /* +0x0000 */ unsigned short Segment; /* +0x0008 */ unsigned char Mode[4]; /* +0x000c b5 13 00 00 */ }; struct _tagADDRESS { unsigned long Offset; /* +0x0000 */ unsigned short Segment; /* +0x0004 */ unsigned char Mode[4]; /* +0x0008 b5 13 00 00 */ }; struct _KDHELP64 { unsigned long long Thread; /* +0x0000 */ unsigned long ThCallbackStack; /* +0x0008 */ unsigned long ThCallbackBStore; /* +0x000c */ unsigned long NextCallback; /* +0x0010 */ unsigned long FramePointer; /* +0x0014 */ unsigned long long KiCallUserMode; /* +0x0018 */ unsigned long long KeUserCallbackDispatcher; /* +0x0020 */ unsigned long long SystemRangeStart; /* +0x0028 */ unsigned long long KiUserExceptionDispatcher; /* +0x0030 */ unsigned long long StackBase; /* +0x0038 */ unsigned long long StackLimit; /* +0x0040 */ unsigned char Reserved[40]; /* +0x0048 bf 13 00 00 */ }; struct _KDHELP { unsigned long Thread; /* +0x0000 */ unsigned long ThCallbackStack; /* +0x0004 */ unsigned long NextCallback; /* +0x0008 */ unsigned long FramePointer; /* +0x000c */ unsigned long KiCallUserMode; /* +0x0010 */ unsigned long KeUserCallbackDispatcher; /* +0x0014 */ unsigned long SystemRangeStart; /* +0x0018 */ unsigned long ThCallbackBStore; /* +0x001c */ unsigned long KiUserExceptionDispatcher; /* +0x0020 */ unsigned long StackBase; /* +0x0024 */ unsigned long StackLimit; /* +0x0028 */ unsigned char Reserved[20]; /* +0x002c 97 10 00 00 */ }; enum _KINTERRUPT_MODE { LevelSensitive = 0, Latched = 1 }; enum _WDF_INTERRUPT_POLARITY { WdfInterruptPolarityUnknown = 0, WdfInterruptActiveHigh = 1, WdfInterruptActiveLow = 2 }; struct _WDF_INTERRUPT_INFO { unsigned long Size; /* +0x0000 */ unsigned long long Reserved1; /* +0x0008 */ unsigned long TargetProcessorSet; /* +0x0010 */ unsigned long Reserved2; /* +0x0014 */ unsigned long MessageNumber; /* +0x0018 */ unsigned long Vector; /* +0x001c */ unsigned char Irql; /* +0x0020 */ unsigned char Mode[4]; /* +0x0024 c9 13 00 00 */ unsigned char Polarity[4]; /* +0x0028 cb 13 00 00 */ unsigned char MessageSignaled; /* +0x002c */ unsigned char ShareDisposition; /* +0x002d */ unsigned short Group; /* +0x0030 */ }; enum _WDF_INTERRUPT_POLICY { WdfIrqPolicyMachineDefault = 0, WdfIrqPolicyAllCloseProcessors = 1, WdfIrqPolicyOneCloseProcessor = 2, WdfIrqPolicyAllProcessorsInMachine = 3, WdfIrqPolicySpecifiedProcessors = 4, WdfIrqPolicySpreadMessagesAcrossAllProcessors = 5 }; enum _WDF_INTERRUPT_PRIORITY { WdfIrqPriorityUndefined = 0, WdfIrqPriorityLow = 1, WdfIrqPriorityNormal = 2, WdfIrqPriorityHigh = 3 }; struct _WDF_INTERRUPT_EXTENDED_POLICY { unsigned long Size; /* +0x0000 */ unsigned char Policy[4]; /* +0x0004 d1 13 00 00 */ unsigned char Priority[4]; /* +0x0008 d3 13 00 00 */ unsigned char TargetProcessorSetAndGroup[12]; /* +0x000c d4 13 00 00 */ }; struct _WUDFMESSAGE_ADD_DEVICE { unsigned char Header[4]; /* +0x0000 db 13 00 00 */ unsigned long AttachDeviceNameOffset; /* +0x0004 */ unsigned char InternalReferenceStringValid[4]; /* +0x0008 39 10 00 00 */ unsigned char InternalReferenceStringOffset[8]; /* +0x000c 2c 10 00 00 */ unsigned long PdoNameOffset; /* +0x0014 */ void *DeviceObjectPointer; /* +0x0018 */ }; enum _WUDF_CONTROL_OBJ_REF_STRING { WudfRefStringMin = 0, WudfRefStringElevations = 0, WudfRefStringNullFile = 1, WudfRefStringMax = 2, WudfRefStringUnknown = 2 }; struct _WUDFMESSAGE_CREATE { /* unsigned char Header[0]; +0x0000 db 13 00 00 */ unsigned char IoHeader[24]; /* +0x0000 e5 13 00 00 */ unsigned char DevnodeContext[4]; /* +0x0018 de 13 00 00 */ unsigned long FileNameByteLength; /* +0x001c */ unsigned long Options; /* +0x0020 */ unsigned short FileAttributes; /* +0x0024 */ unsigned short ShareAccess; /* +0x0026 */ unsigned long DesiredAccess; /* +0x0028 */ unsigned char RelatedCreateContext[4]; /* +0x002c e7 13 00 00 */ unsigned long InitiatorProcessId; /* +0x0030 */ }; struct _WUDFMESSAGE_REPLY_HEADER { long NtStatus; /* +0x0000 */ }; struct _WUDFMESSAGE_IO_REPLY { unsigned char Header[4]; /* +0x0000 eb 13 00 00 */ unsigned long Information; /* +0x0004 */ }; struct _WDFPROCMGMT_MESSAGE_QUERY_PROCESS_REPLY { unsigned char Header[4]; /* +0x0000 eb 13 00 00 */ unsigned long ProcessTimeout; /* +0x0004 */ }; struct _WDFPROCMGMT_MESSAGE_OPEN_PROCESS_REPLY { unsigned char Header[4]; /* +0x0000 eb 13 00 00 */ void *ProcessHandle; /* +0x0004 */ }; struct _WUDFMESSAGE_REMOTE_INTERFACE_ARRIVAL { unsigned char Header[4]; /* +0x0000 db 13 00 00 */ unsigned char InterfaceGuid[16]; /* +0x0004 13 10 00 00 */ unsigned char DevnodeContext[4]; /* +0x0014 de 13 00 00 */ unsigned char DeviceContext[4]; /* +0x0018 02 14 00 00 */ }; struct _WUDFMESSAGE_TARGET_DEVICE_NOTIFICATION { unsigned char Header[4]; /* +0x0000 db 13 00 00 */ unsigned char Event[16]; /* +0x0004 13 10 00 00 */ unsigned char DevnodeContext[4]; /* +0x0014 de 13 00 00 */ unsigned long long TargetContext; /* +0x0018 */ unsigned long CustomBufferSize; /* +0x0020 */ unsigned long NameBufferOffset; /* +0x0024 */ }; struct _WUDFMESSAGE_TRANSPORT_QUERY_ID { unsigned char Header[4]; /* +0x0000 db 13 00 00 */ unsigned char DevnodeContext[4]; /* +0x0004 de 13 00 00 */ unsigned long Id; /* +0x0008 */ unsigned long BufferSize; /* +0x000c */ }; struct WUDF_EVENT { void *Value; /* +0x0000 */ }; struct _ALPC_MESSAGE_ATTRIBUTES { unsigned long AllocatedAttributes; /* +0x0000 */ unsigned long ValidAttributes; /* +0x0004 */ }; struct WdfCtorStatus { long m_ConstructorStatus; /* +0x0000 */ }; enum WdfDriverStopType { WdfInternalError = 0, WdfDriverError = 1, WdfCallerError = 2, WdfExternalError = 3, WdfUnhandledExceptionError = 4, WdfDriverStopTypeMax = 5 }; enum WdfErrorClass { WdfErrorClass_Undefined = 0, WdfErrorClass_BadArgument = 1, WdfErrorClass_BadState = 2, WdfErrorClass_BadResponse = 3, WdfErrorClass_BadAction = 4, WdfErrorClass_LostReference = 5, WdfErrorClass_GlobalMax = 6, WdfErrorClass_PlatformStart = 6, WdfErrorClass_PlatformMax = 7, WdfErrorClass_RdStart = 6, WdfErrorClass_RdMax = 7, WdfErrorClass_DmStart = 6, WdfErrorClass_DmMax = 7, WdfErrorClass_HostStart = 6, WdfErrorClass_HostMax = 7, WdfErrorClass_FxStart = 6, WdfErrorClass_FxMax = 7, WdfErrorClass_TestStart = 6, WdfErrorClass_TestMax = 7 }; enum WELL_KNOWN_SID_TYPE { WinNullSid = 0, WinWorldSid = 1, WinLocalSid = 2, WinCreatorOwnerSid = 3, WinCreatorGroupSid = 4, WinCreatorOwnerServerSid = 5, WinCreatorGroupServerSid = 6, WinNtAuthoritySid = 7, WinDialupSid = 8, WinNetworkSid = 9, WinBatchSid = 10, WinInteractiveSid = 11, WinServiceSid = 12, WinAnonymousSid = 13, WinProxySid = 14, WinEnterpriseControllersSid = 15, WinSelfSid = 16, WinAuthenticatedUserSid = 17, WinRestrictedCodeSid = 18, WinTerminalServerSid = 19, WinRemoteLogonIdSid = 20, WinLogonIdsSid = 21, WinLocalSystemSid = 22, WinLocalServiceSid = 23, WinNetworkServiceSid = 24, WinBuiltinDomainSid = 25, WinBuiltinAdministratorsSid = 26, WinBuiltinUsersSid = 27, WinBuiltinGuestsSid = 28, WinBuiltinPowerUsersSid = 29, WinBuiltinAccountOperatorsSid = 30, WinBuiltinSystemOperatorsSid = 31, WinBuiltinPrintOperatorsSid = 32, WinBuiltinBackupOperatorsSid = 33, WinBuiltinReplicatorSid = 34, WinBuiltinPreWindows2000CompatibleAccessSid = 35, WinBuiltinRemoteDesktopUsersSid = 36, WinBuiltinNetworkConfigurationOperatorsSid = 37, WinAccountAdministratorSid = 38, WinAccountGuestSid = 39, WinAccountKrbtgtSid = 40, WinAccountDomainAdminsSid = 41, WinAccountDomainUsersSid = 42, WinAccountDomainGuestsSid = 43, WinAccountComputersSid = 44, WinAccountControllersSid = 45, WinAccountCertAdminsSid = 46, WinAccountSchemaAdminsSid = 47, WinAccountEnterpriseAdminsSid = 48, WinAccountPolicyAdminsSid = 49, WinAccountRasAndIasServersSid = 50, WinNTLMAuthenticationSid = 51, WinDigestAuthenticationSid = 52, WinSChannelAuthenticationSid = 53, WinThisOrganizationSid = 54, WinOtherOrganizationSid = 55, WinBuiltinIncomingForestTrustBuildersSid = 56, WinBuiltinPerfMonitoringUsersSid = 57, WinBuiltinPerfLoggingUsersSid = 58, WinBuiltinAuthorizationAccessSid = 59, WinBuiltinTerminalServerLicenseServersSid = 60, WinBuiltinDCOMUsersSid = 61, WinBuiltinIUsersSid = 62, WinIUserSid = 63, WinBuiltinCryptoOperatorsSid = 64, WinUntrustedLabelSid = 65, WinLowLabelSid = 66, WinMediumLabelSid = 67, WinHighLabelSid = 68, WinSystemLabelSid = 69, WinWriteRestrictedCodeSid = 70, WinCreatorOwnerRightsSid = 71, WinCacheablePrincipalsGroupSid = 72, WinNonCacheablePrincipalsGroupSid = 73, WinEnterpriseReadonlyControllersSid = 74, WinAccountReadonlyControllersSid = 75, WinBuiltinEventLogReadersGroup = 76, WinNewEnterpriseReadonlyControllersSid = 77, WinBuiltinCertSvcDComAccessGroup = 78, WinMediumPlusLabelSid = 79, WinLocalLogonSid = 80, WinConsoleLogonSid = 81, WinThisOrganizationCertificateSid = 82, WinApplicationPackageAuthoritySid = 83, WinBuiltinAnyPackageSid = 84, WinCapabilityInternetClientSid = 85, WinCapabilityInternetClientServerSid = 86, WinCapabilityPrivateNetworkClientServerSid = 87, WinCapabilityPicturesLibrarySid = 88, WinCapabilityVideosLibrarySid = 89, WinCapabilityMusicLibrarySid = 90, WinCapabilityDocumentsLibrarySid = 91, WinCapabilitySharedUserCertificatesSid = 92, WinCapabilityDefaultWindowsCredentialsSid = 93, WinCapabilityRemovableStorageSid = 94, WinBuiltinRDSRemoteAccessServersSid = 95, WinBuiltinRDSEndpointServersSid = 96, WinBuiltinRDSManagementServersSid = 97, WinUserModeDriversSid = 98, WinBuiltinHyperVAdminsSid = 99 }; enum WdfPoolType { WdfNonPagedPool = 0, WdfPagedPool = 1, WdfPoolChargeQuota = 128 }; struct _IMAGE_THUNK_DATA32:: { unsigned long ForwarderString; /* +0x0000 */ unsigned long Function; /* +0x0000 */ unsigned long Ordinal; /* +0x0000 */ unsigned long AddressOfData; /* +0x0000 */ }; struct _OSVERSIONINFOEXW { unsigned long dwOSVersionInfoSize; /* +0x0000 */ unsigned long dwMajorVersion; /* +0x0004 */ unsigned long dwMinorVersion; /* +0x0008 */ unsigned long dwBuildNumber; /* +0x000c */ unsigned long dwPlatformId; /* +0x0010 */ unsigned char szCSDVersion[256]; /* +0x0014 19 13 00 00 */ unsigned short wServicePackMajor; /* +0x0114 */ unsigned short wServicePackMinor; /* +0x0116 */ unsigned short wSuiteMask; /* +0x0118 */ unsigned char wProductType; /* +0x011a */ unsigned char wReserved; /* +0x011b */ }; struct WudfMessageTracker { unsigned long m_TimeToLiveInSeconds; /* +0x0000 */ unsigned char m_TimedOut; /* +0x0004 */ }; struct WudfLpcMessageParameters { unsigned char m_LpcMessage[4]; /* +0x0000 3e 15 00 00 */ unsigned long m_MessageId; /* +0x0004 */ }; struct _PORT_MESSAGE:::: { short DataLength; /* +0x0000 */ short TotalLength; /* +0x0002 */ }; struct WdfLpcPortParameters { unsigned char m_ServerPortName[4]; /* +0x0000 10 10 00 00 */ unsigned char m_Notification[4]; /* +0x0004 ad 15 00 00 */ unsigned char m_Lpc[4]; /* +0x0008 af 15 00 00 */ void *m_PortHandle; /* +0x000c */ unsigned char m_Owner[4]; /* +0x0010 5b 13 00 00 */ }; enum _MODE { KernelMode = 0, UserMode = 1, MaximumMode = 2 }; enum _SECURITY_IMPERSONATION_LEVEL { SecurityAnonymous = 0, SecurityIdentification = 1, SecurityImpersonation = 2, SecurityDelegation = 3 }; enum _ALPC_PORT_INFORMATION_CLASS { AlpcBasicInformation = 0, AlpcPortInformation = 1, AlpcAssociateCompletionPortInformation = 2, AlpcConnectedSIDInformation = 3, AlpcServerInformation = 4, AlpcMessageZoneInformation = 5, AlpcRegisterCompletionListInformation = 6, AlpcUnregisterCompletionListInformation = 7, AlpcAdjustCompletionListConcurrencyCountInformation = 8, AlpcRegisterCallbackInformation = 9, AlpcCompletionListRundownInformation = 10 }; enum _WUDFMESSAGE { WudfMsg_Reserved = 0, WudfMsg_IRP = 1, WudfMsg_IRP_Completion = 2, WudfMsg_CREATE_DEVICE_STACK = 3, WudfMsg_ADD_DEVICE = 4, WudfMsg_CREATE = 5, WudfMsg_CLOSE = 6, WudfMsg_CLEANUP = 7, WudfMsg_READ = 8, WudfMsg_WRITE = 9, WudfMsg_IOCONTROL = 10, WudfMsg_FLUSH = 11, WudfMsg_QUERY_INFORMATION_FILE = 12, WudfMsg_SET_INFORMATION_FILE = 13, WudfMsg_Cancel = 14, WudfMsg_POWER_IRP_COMPLETE = 15, WudfMsg_USB_SS_EVENT = 16, WudfMsg_CLOSE_DEVICE_STACK = 17, WudfMsg_REMOTE_INTERFACE_ARRIVAL = 18, WudfMsg_REMOTE_INTERFACE_REMOVAL = 19, WudfMsg_TARGET_DEVICE_NOTIFICATION = 20, WudfMsg_TRANSPORT_QUERY_ID = 21, WudfMsg_FramworkMax = 22, WudfMsg_ExitProcess = 23, WdfProcMgmt_Message_Reserved = 24, WdfProcMgmt_Message_ControlObjectName = 25, WdfProcMgmt_Message_QueryProcess = 26, WdfProcMgmt_Message_OpenProcess = 27, WdfProcMgmt_Message_CloseProcess = 28, WudfMsg_Connect = 29, WudfMsg_WMI_POWER_DATA = 30, WudfMsg_Max = 31 }; struct _WDF_ACTIVATION_FRAME { unsigned char ListHead[4]; /* +0x0000 40 17 00 00 */ unsigned char NextFrame[4]; /* +0x0004 3f 17 00 00 */ void *Caller; /* +0x0008 */ }; struct _MCGEN_TRACE_CONTEXT { unsigned long long RegistrationHandle; /* +0x0000 */ unsigned long long Logger; /* +0x0008 */ unsigned long long MatchAnyKeyword; /* +0x0010 */ unsigned long long MatchAllKeyword; /* +0x0018 */ unsigned long Flags; /* +0x0020 */ unsigned long IsEnabled; /* +0x0024 */ unsigned char Level; /* +0x0028 */ unsigned char Reserve; /* +0x0029 */ unsigned short EnableBitsCount; /* +0x002a */ unsigned long *EnableBitMask; /* +0x002c */ unsigned char EnableKeyWords[4]; /* +0x0030 f5 11 00 00 */ unsigned char EnableLevel[4]; /* +0x0034 f3 11 00 00 */ }; enum WMIDPREQUESTCODE { WMI_GET_ALL_DATA = 0, WMI_GET_SINGLE_INSTANCE = 1, WMI_SET_SINGLE_INSTANCE = 2, WMI_SET_SINGLE_ITEM = 3, WMI_ENABLE_EVENTS = 4, WMI_DISABLE_EVENTS = 5, WMI_ENABLE_COLLECTION = 6, WMI_DISABLE_COLLECTION = 7, WMI_REGINFO = 8, WMI_EXECUTE_METHOD = 9, WMI_CAPTURE_STATE = 10 }; struct _EVENT_FILTER_DESCRIPTOR { unsigned long long Ptr; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned long Type; /* +0x000c */ }; struct _TRACE_GUID_REGISTRATION { unsigned char Guid[4]; /* +0x0000 15 10 00 00 */ void *RegHandle; /* +0x0004 */ }; struct _EVENT_TRACE_HEADER { unsigned short Size; /* +0x0000 */ unsigned short FieldTypeFlags; /* +0x0002 */ unsigned char HeaderType; /* +0x0002 */ unsigned char MarkerFlags; /* +0x0003 */ unsigned long Version; /* +0x0004 */ unsigned char Class[4]; /* +0x0004 8a 17 00 00 */ unsigned long ThreadId; /* +0x0008 */ unsigned long ProcessId; /* +0x000c */ unsigned char TimeStamp[8]; /* +0x0010 34 10 00 00 */ /* unsigned char Guid[0]; +0x0018 13 10 00 00 */ unsigned long long GuidPtr; /* +0x0018 */ unsigned long KernelTime; /* +0x0028 */ unsigned long UserTime; /* +0x002c */ unsigned long long ProcessorTime; /* +0x0028 */ unsigned long ClientContext; /* +0x0028 */ unsigned long Flags; /* +0x002c */ }; struct _EVENT_TRACE_HEADER:::: { unsigned char Type; /* +0x0000 */ unsigned char Level; /* +0x0001 */ unsigned short Version; /* +0x0002 */ }; struct MofTemplate_jzccppppq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 87 17 00 00 */ unsigned char EventData[144]; /* +0x0030 7f 17 00 00 */ }; struct MofTemplate_z::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 87 17 00 00 */ unsigned char EventData[16]; /* +0x0030 96 17 00 00 */ }; struct MofTemplate_zq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 87 17 00 00 */ unsigned char EventData[32]; /* +0x0030 9b 17 00 00 */ }; struct MofTemplate_jzz::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 87 17 00 00 */ unsigned char EventData[48]; /* +0x0030 a0 17 00 00 */ }; struct MofTemplate_jcccqqq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 87 17 00 00 */ unsigned char EventData[112]; /* +0x0030 a9 17 00 00 */ }; struct MofTemplate_jzqzj::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 87 17 00 00 */ unsigned char EventData[80]; /* +0x0030 b2 17 00 00 */ }; struct MofTemplate_jzzzzz::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 87 17 00 00 */ unsigned char EventData[96]; /* +0x0030 b7 17 00 00 */ }; struct MofTemplate_jzqq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 87 17 00 00 */ unsigned char EventData[64]; /* +0x0030 bc 17 00 00 */ }; enum WDF_REGISTRY_READ_RESULT { ValuePresent = 0, ValueNotPresent = 1, ValueInvalid = 2 }; enum WDF_MODULE_INFO_CHANGE_TYPE { ModuleLoaded = 0, ModuleUnloaded = 1 }; enum WudfBreakPointType { WudfPlatformUserBreakin = 1, WudfPlatformKernelBreakin = 2, WudfPlatformUserOrKernelBreakin = 3 }; enum WudfDebuggerType { WudfPlatformUserDebugger = 0, WudfPlatformUserOrKernelDebugger = 1 }; struct WDF_PROCESS_INFORMATION { unsigned char Component[4]; /* +0x0000 5b 13 00 00 */ unsigned char GlobalTraceSessionName[4]; /* +0x0004 10 10 00 00 */ unsigned char RootDirectoryPath[4]; /* +0x0008 10 10 00 00 */ unsigned char TraceFilePath[4]; /* +0x000c 10 10 00 00 */ unsigned char FullDumpFileName[4]; /* +0x0010 10 10 00 00 */ unsigned char FullConfigLogName[4]; /* +0x0014 10 10 00 00 */ unsigned char IsWUDFTraceEnabled[4]; /* +0x0018 30 00 00 00 */ }; struct WUDF_PLATFORM_THREAD_DATA { unsigned char Thread[4]; /* +0x0000 06 18 00 00 */ unsigned char TrackerList[4]; /* +0x0004 3f 17 00 00 */ void *OverlappedEvent; /* +0x0008 */ }; struct _EVENT_TRACE_PROPERTIES { unsigned char Wnode[48]; /* +0x0000 28 1a 00 00 */ unsigned long BufferSize; /* +0x0030 */ unsigned long MinimumBuffers; /* +0x0034 */ unsigned long MaximumBuffers; /* +0x0038 */ unsigned long MaximumFileSize; /* +0x003c */ unsigned long LogFileMode; /* +0x0040 */ unsigned long FlushTimer; /* +0x0044 */ unsigned long EnableFlags; /* +0x0048 */ long AgeLimit; /* +0x004c */ unsigned long NumberOfBuffers; /* +0x0050 */ unsigned long FreeBuffers; /* +0x0054 */ unsigned long EventsLost; /* +0x0058 */ unsigned long BuffersWritten; /* +0x005c */ unsigned long LogBuffersLost; /* +0x0060 */ unsigned long RealTimeBuffersLost; /* +0x0064 */ void *LoggerThreadId; /* +0x0068 */ unsigned long LogFileNameOffset; /* +0x006c */ unsigned long LoggerNameOffset; /* +0x0070 */ }; enum CTraceSession:: { NotRunning = 0, Disabled = 1, Running = 2, PreviouslyRunning = 3 }; struct _WER_REPORT_INFORMATION { unsigned long dwSize; /* +0x0000 */ void *hProcess; /* +0x0004 */ unsigned char wzConsentKey[128]; /* +0x0008 9b 1a 00 00 */ unsigned char wzFriendlyEventName[256]; /* +0x0088 19 13 00 00 */ unsigned char wzApplicationName[256]; /* +0x0188 19 13 00 00 */ unsigned char wzApplicationPath[520]; /* +0x0288 2b 10 00 00 */ unsigned char wzDescription[1024]; /* +0x0490 9c 1a 00 00 */ unsigned char hwndParent[4]; /* +0x0890 9e 1a 00 00 */ }; struct tagCABSTR { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 e6 10 00 00 */ }; struct _s__RTTIBaseClassDescriptor2 { unsigned char pTypeDescriptor[4]; /* +0x0000 cf 1a 00 00 */ unsigned long numContainedBases; /* +0x0004 */ unsigned char where[12]; /* +0x0008 d0 1a 00 00 */ unsigned long attributes; /* +0x0014 */ unsigned char pClassDescriptor[4]; /* +0x0018 d3 1a 00 00 */ }; struct tagCAUL { unsigned long cElems; /* +0x0000 */ unsigned long *pElems; /* +0x0004 */ }; struct tagCASCODE { unsigned long cElems; /* +0x0000 */ long *pElems; /* +0x0004 */ }; struct _SYSTEMTIME { unsigned short wYear; /* +0x0000 */ unsigned short wMonth; /* +0x0002 */ unsigned short wDayOfWeek; /* +0x0004 */ unsigned short wDay; /* +0x0006 */ unsigned short wHour; /* +0x0008 */ unsigned short wMinute; /* +0x000a */ unsigned short wSecond; /* +0x000c */ unsigned short wMilliseconds; /* +0x000e */ }; struct threadlocaleinfostruct { unsigned char refcount[4]; /* +0x0000 74 00 00 00 */ unsigned char lc_codepage[4]; /* +0x0004 75 00 00 00 */ unsigned char lc_collate_cp[4]; /* +0x0008 75 00 00 00 */ unsigned char lc_handle[24]; /* +0x000c dc 1a 00 00 */ unsigned char lc_id[180]; /* +0x0024 de 1a 00 00 */ }; struct _ALPC_PORT_ATTRIBUTES { unsigned long Flags; /* +0x0000 */ unsigned char SecurityQos[12]; /* +0x0004 1b 16 00 00 */ unsigned long MaxMessageLength; /* +0x0010 */ unsigned long MemoryBandwidth; /* +0x0014 */ unsigned long MaxPoolUsage; /* +0x0018 */ unsigned long MaxSectionSize; /* +0x001c */ unsigned long MaxViewSize; /* +0x0020 */ unsigned long MaxTotalSectionSize; /* +0x0024 */ unsigned long DupObjectTypes; /* +0x0028 */ }; enum _tagPARSEACTION { PARSE_CANONICALIZE = 1, PARSE_FRIENDLY = 2, PARSE_SECURITY_URL = 3, PARSE_ROOTDOCUMENT = 4, PARSE_DOCUMENT = 5, PARSE_ANCHOR = 6, PARSE_ENCODE_IS_UNESCAPE = 7, PARSE_DECODE_IS_ESCAPE = 8, PARSE_PATH_FROM_URL = 9, PARSE_URL_FROM_PATH = 10, PARSE_MIME = 11, PARSE_SERVER = 12, PARSE_SCHEMA = 13, PARSE_SITE = 14, PARSE_DOMAIN = 15, PARSE_LOCATION = 16, PARSE_SECURITY_DOMAIN = 17, PARSE_ESCAPE = 18, PARSE_UNESCAPE = 19 }; struct tagCABOOL { unsigned long cElems; /* +0x0000 */ short *pElems; /* +0x0004 */ }; enum _tagINTERNETFEATURELIST { FEATURE_OBJECT_CACHING = 0, FEATURE_ZONE_ELEVATION = 1, FEATURE_MIME_HANDLING = 2, FEATURE_MIME_SNIFFING = 3, FEATURE_WINDOW_RESTRICTIONS = 4, FEATURE_WEBOC_POPUPMANAGEMENT = 5, FEATURE_BEHAVIORS = 6, FEATURE_DISABLE_MK_PROTOCOL = 7, FEATURE_LOCALMACHINE_LOCKDOWN = 8, FEATURE_SECURITYBAND = 9, FEATURE_RESTRICT_ACTIVEXINSTALL = 10, FEATURE_VALIDATE_NAVIGATE_URL = 11, FEATURE_RESTRICT_FILEDOWNLOAD = 12, FEATURE_ADDON_MANAGEMENT = 13, FEATURE_PROTOCOL_LOCKDOWN = 14, FEATURE_HTTP_USERNAME_PASSWORD_DISABLE = 15, FEATURE_SAFE_BINDTOOBJECT = 16, FEATURE_UNC_SAVEDFILECHECK = 17, FEATURE_GET_URL_DOM_FILEPATH_UNENCODED = 18, FEATURE_TABBED_BROWSING = 19, FEATURE_SSLUX = 20, FEATURE_DISABLE_NAVIGATION_SOUNDS = 21, FEATURE_DISABLE_LEGACY_COMPRESSION = 22, FEATURE_FORCE_ADDR_AND_STATUS = 23, FEATURE_XMLHTTP = 24, FEATURE_DISABLE_TELNET_PROTOCOL = 25, FEATURE_FEEDS = 26, FEATURE_BLOCK_INPUT_PROMPTS = 27, FEATURE_ENTRY_COUNT = 28 }; struct _WUDFMESSAGE_HEADER { unsigned char Message[1]; /* +0x0000 bd 16 00 00 */ }; enum tagCALLCONV { CC_FASTCALL = 0, CC_CDECL = 1, CC_MSCPASCAL = 2, CC_PASCAL = 2, CC_MACPASCAL = 3, CC_STDCALL = 4, CC_FPFASTCALL = 5, CC_SYSCALL = 6, CC_MPWCDECL = 7, CC_MPWPASCAL = 8, CC_MAX = 9 }; struct __MIDL___MIDL_itf_wdfplatform_0000_0000_0002 { unsigned char TraceGuid[16]; /* +0x0000 13 10 00 00 */ unsigned long Flags; /* +0x0010 */ unsigned long Level; /* +0x0014 */ }; struct _s__RTTIClassHierarchyDescriptor { unsigned long signature; /* +0x0000 */ unsigned long attributes; /* +0x0004 */ unsigned long numBaseClasses; /* +0x0008 */ unsigned char pBaseClassArray[4]; /* +0x000c f7 1a 00 00 */ }; enum __MIDL_ICodeInstall_0001 { CIP_DISK_FULL = 0, CIP_ACCESS_DENIED = 1, CIP_NEWER_VERSION_EXISTS = 2, CIP_OLDER_VERSION_EXISTS = 3, CIP_NAME_CONFLICT = 4, CIP_TRUST_VERIFICATION_COMPONENT_MISSING = 5, CIP_EXE_SELF_REGISTERATION_TIMEOUT = 6, CIP_UNSAFE_TO_ABORT = 7, CIP_NEED_REBOOT = 8, CIP_NEED_REBOOT_UI_PERMISSION = 9 }; struct _GROUP_AFFINITY { unsigned long Mask; /* +0x0000 */ unsigned short Group; /* +0x0004 */ unsigned char Reserved[6]; /* +0x0006 fc 1a 00 00 */ }; struct $_TypeDescriptor$_extraBytes_24 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[24]; /* +0x0008 00 1b 00 00 */ }; struct _s__RTTICompleteObjectLocator { unsigned long signature; /* +0x0000 */ unsigned long offset; /* +0x0004 */ unsigned long cdOffset; /* +0x0008 */ unsigned char pTypeDescriptor[4]; /* +0x000c cf 1a 00 00 */ unsigned char pClassDescriptor[4]; /* +0x0010 d3 1a 00 00 */ }; struct _SP_DEVINFO_DATA { unsigned long cbSize; /* +0x0000 */ unsigned char ClassGuid[16]; /* +0x0004 13 10 00 00 */ unsigned long DevInst; /* +0x0014 */ unsigned long Reserved; /* +0x0018 */ }; struct _TEB_ACTIVE_FRAME { unsigned long Flags; /* +0x0000 */ unsigned char Previous[4]; /* +0x0004 a7 10 00 00 */ unsigned char Context[4]; /* +0x0008 0c 1b 00 00 */ }; enum DISPLAYCONFIG_SCANLINE_ORDERING { DISPLAYCONFIG_SCANLINE_ORDERING_UNSPECIFIED = 0, DISPLAYCONFIG_SCANLINE_ORDERING_PROGRESSIVE = 1, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED = 2, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_UPPERFIELDFIRST = 2, DISPLAYCONFIG_SCANLINE_ORDERING_INTERLACED_LOWERFIELDFIRST = 3, DISPLAYCONFIG_SCANLINE_ORDERING_FORCE_UINT32 = -1 }; struct tagBLOB { unsigned long cbSize; /* +0x0000 */ unsigned char *pBlobData; /* +0x0004 */ }; enum tagCOWAIT_FLAGS { COWAIT_WAITALL = 1, COWAIT_ALERTABLE = 2, COWAIT_INPUTAVAILABLE = 4, COWAIT_DISPATCH_CALLS = 8, COWAIT_DISPATCH_WINDOW_MESSAGES = 16, REAL_COWAIT_ENABLECALLREENTRANCY = 8, COWAIT_ENABLEWINDOWMESSAGES = 16, COWAIT_ENABLECALLREENTRANCY = 24 }; struct _PMD { unsigned char mdisp[4]; /* +0x0000 74 00 00 00 */ unsigned char pdisp[4]; /* +0x0004 74 00 00 00 */ unsigned char vdisp[4]; /* +0x0008 74 00 00 00 */ }; struct tagCAC { unsigned long cElems; /* +0x0000 */ char *pElems; /* +0x0004 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_4 { unsigned char arrayOfBaseClassDescriptors[5]; /* +0x0000 1b 1b 00 00 */ }; struct _SECURITY_QUALITY_OF_SERVICE { unsigned long Length; /* +0x0000 */ unsigned char ImpersonationLevel[4]; /* +0x0004 cc 15 00 00 */ unsigned char ContextTrackingMode; /* +0x0008 */ unsigned char EffectiveOnly; /* +0x0009 */ }; struct tagCACLSID { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 7b 13 00 00 */ }; struct _NT_TIB { unsigned char ExceptionList[4]; /* +0x0000 24 1b 00 00 */ void *StackBase; /* +0x0004 */ void *StackLimit; /* +0x0008 */ void *SubSystemTib; /* +0x000c */ void *FiberData; /* +0x0010 */ unsigned long Version; /* +0x0010 */ void *ArbitraryUserPointer; /* +0x0014 */ unsigned char Self[4]; /* +0x0018 25 1b 00 00 */ }; struct _NT_TIB:: { void *FiberData; /* +0x0000 */ unsigned long Version; /* +0x0000 */ }; struct $_TypeDescriptor$_extraBytes_22 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[22]; /* +0x0008 2b 1b 00 00 */ }; struct tagCAUH { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 2f 1b 00 00 */ }; struct _TEB:: { /* unsigned char CurrentIdealProcessor[0]; +0x0000 a5 10 00 00 */ unsigned long IdealProcessorValue; /* +0x0000 */ unsigned char ReservedPad0; /* +0x0000 */ unsigned char ReservedPad1; /* +0x0001 */ unsigned char ReservedPad2; /* +0x0002 */ unsigned char IdealProcessor; /* +0x0003 */ }; struct _TEB:::: { unsigned char ReservedPad0; /* +0x0000 */ unsigned char ReservedPad1; /* +0x0001 */ unsigned char ReservedPad2; /* +0x0002 */ unsigned char IdealProcessor; /* +0x0003 */ }; struct _TEB:: { /* unsigned char CrossTebFlags[0]; +0x0000 a8 10 00 00 */ unsigned char SpareCrossTebBits[2]; /* +0x0000 a9 10 00 00 */ }; struct _TEB:::: { unsigned char SpareCrossTebBits[2]; /* +0x0000 a9 10 00 00 */ }; struct _TEB:: { unsigned short SameTebFlags; /* +0x0000 */ /* unsigned char SafeThunkCall[0]; +0x0000 aa 10 00 00 */ /* unsigned char InDebugPrint[0]; +0x0000 ab 10 00 00 */ /* unsigned char HasFiberData[0]; +0x0000 ac 10 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x0000 ad 10 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x0000 ae 10 00 00 */ /* unsigned char RanProcessInit[0]; +0x0000 af 10 00 00 */ /* unsigned char ClonedThread[0]; +0x0000 b0 10 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x0000 b1 10 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x0000 b2 10 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x0000 b3 10 00 00 */ /* unsigned char InitialThread[0]; +0x0000 b4 10 00 00 */ /* unsigned char SessionAware[0]; +0x0000 b5 10 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x0000 b6 10 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x0000 b7 10 00 00 */ }; struct _TEB:::: { /* unsigned char SafeThunkCall[0]; +0x0000 aa 10 00 00 */ /* unsigned char InDebugPrint[0]; +0x0000 ab 10 00 00 */ /* unsigned char HasFiberData[0]; +0x0000 ac 10 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x0000 ad 10 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x0000 ae 10 00 00 */ /* unsigned char RanProcessInit[0]; +0x0000 af 10 00 00 */ /* unsigned char ClonedThread[0]; +0x0000 b0 10 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x0000 b1 10 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x0000 b2 10 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x0000 b3 10 00 00 */ /* unsigned char InitialThread[0]; +0x0000 b4 10 00 00 */ /* unsigned char SessionAware[0]; +0x0000 b5 10 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x0000 b6 10 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x0000 b7 10 00 00 */ }; struct _IMAGE_FILE_HEADER { unsigned short Machine; /* +0x0000 */ unsigned short NumberOfSections; /* +0x0002 */ unsigned long TimeDateStamp; /* +0x0004 */ unsigned long PointerToSymbolTable; /* +0x0008 */ unsigned long NumberOfSymbols; /* +0x000c */ unsigned short SizeOfOptionalHeader; /* +0x0010 */ unsigned short Characteristics; /* +0x0012 */ }; enum _WDF_PROPERTY_STORE_RETRIEVE_FLAGS { WdfPropertyStoreNormal = 0, WdfPropertyStoreCreateIfMissing = 1, WdfPropertyStoreCreateVolatile = 2, WdfPropertyStoreRetrieveFlagsMask = 3 }; enum _USER_ACTIVITY_PRESENCE { PowerUserPresent = 0, PowerUserNotPresent = 1, PowerUserInactive = 2, PowerUserMaximum = 3, PowerUserInvalid = 3 }; struct _ALPC_SECURITY_ATTR { unsigned long Flags; /* +0x0000 */ unsigned char QoS[4]; /* +0x0004 1c 16 00 00 */ void *ContextHandle; /* +0x0008 */ }; struct tagCADBL { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 41 04 00 00 */ }; struct tagCACLIPDATA { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 7d 13 00 00 */ }; enum tagCHANGEKIND { CHANGEKIND_ADDMEMBER = 0, CHANGEKIND_DELETEMEMBER = 1, CHANGEKIND_SETNAMES = 2, CHANGEKIND_SETDOCUMENTATION = 3, CHANGEKIND_GENERAL = 4, CHANGEKIND_INVALIDATE = 5, CHANGEKIND_CHANGEFAILED = 6, CHANGEKIND_MAX = 7 }; struct tagCABSTRBLOB { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 4d 1b 00 00 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_20 { unsigned char arrayOfBaseClassDescriptors[21]; /* +0x0000 51 1b 00 00 */ }; struct _KUSER_SHARED_DATA:: { unsigned char MitigationPolicies; /* +0x0000 */ /* unsigned char NXSupportPolicy[0]; +0x0000 35 10 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x0000 36 10 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x0000 37 10 00 00 */ unsigned char Reserved[1]; /* +0x0000 38 10 00 00 */ }; struct _KUSER_SHARED_DATA:::: { /* unsigned char NXSupportPolicy[0]; +0x0000 35 10 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x0000 36 10 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x0000 37 10 00 00 */ unsigned char Reserved[1]; /* +0x0000 38 10 00 00 */ }; struct _KUSER_SHARED_DATA:: { unsigned long SharedDataFlags; /* +0x0000 */ /* unsigned char DbgErrorPortPresent[0]; +0x0000 3b 10 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x0000 3c 10 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x0000 3d 10 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x0000 3e 10 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x0000 3f 10 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x0000 40 10 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x0000 41 10 00 00 */ unsigned char SpareBits[4]; /* +0x0000 42 10 00 00 */ }; struct _KUSER_SHARED_DATA:::: { /* unsigned char DbgErrorPortPresent[0]; +0x0000 3b 10 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x0000 3c 10 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x0000 3d 10 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x0000 3e 10 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x0000 3f 10 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x0000 40 10 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x0000 41 10 00 00 */ unsigned char SpareBits[4]; /* +0x0000 42 10 00 00 */ }; struct _KUSER_SHARED_DATA:: { /* unsigned char TickCount[0]; +0x0000 23 10 00 00 */ /* unsigned char TickCountQuad[0]; +0x0000 44 10 00 00 */ unsigned char ReservedTickCountOverlay[12]; /* +0x0000 45 10 00 00 */ unsigned char TickCountPad[4]; /* +0x000c 33 10 00 00 */ }; struct _KUSER_SHARED_DATA:::: { unsigned char ReservedTickCountOverlay[12]; /* +0x0000 45 10 00 00 */ unsigned char TickCountPad[4]; /* +0x000c 33 10 00 00 */ }; struct _KUSER_SHARED_DATA:: { unsigned short TscQpcData; /* +0x0000 */ unsigned char TscQpcEnabled[1]; /* +0x0000 48 10 00 00 */ unsigned char TscQpcShift; /* +0x0001 */ }; struct _KUSER_SHARED_DATA:::: { unsigned char TscQpcEnabled[1]; /* +0x0000 48 10 00 00 */ unsigned char TscQpcShift; /* +0x0001 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_64 { unsigned char arrayOfBaseClassDescriptors[65]; /* +0x0000 65 1b 00 00 */ }; struct _WUDFMESSAGE_REPLY_ALL { /* unsigned char WudfMsg_CREATE_DEVICE_STACK_Reply[0]; +0x0000 68 1b 00 00 */ /* unsigned char WudfMsg_ADD_DEVICE_Reply[0]; +0x0000 69 1b 00 00 */ /* unsigned char WudfMsg_CREATE_Reply[0]; +0x0000 6a 1b 00 00 */ /* unsigned char WudfMsg_CLOSE_Reply[0]; +0x0000 6b 1b 00 00 */ /* unsigned char WudfMsg_CLEANUP_Reply[0]; +0x0000 6c 1b 00 00 */ /* unsigned char WudfMsg_IO_Reply[0]; +0x0000 ef 13 00 00 */ /* unsigned char WudfMsg_CANCEL_Reply[0]; +0x0000 6d 1b 00 00 */ /* unsigned char WudfMsg_POWER_IRP_COMPLETE_Reply[0]; +0x0000 6e 1b 00 00 */ /* unsigned char WudfMsg_USB_SS_EVENT_Reply[0]; +0x0000 6f 1b 00 00 */ /* unsigned char WudfMsg_REMOTE_INTERFACE_ARRIVAL_Reply[0]; +0x0000 70 1b 00 00 */ /* unsigned char WudfMsg_REMOTE_INTERFACE_REMOVAL_Reply[0]; +0x0000 71 1b 00 00 */ /* unsigned char WudfMsg_TARGET_DEVICE_NOTIFICATION_Reply[0]; +0x0000 72 1b 00 00 */ /* unsigned char WudfMsg_TRANSPORT_QUERY_ID_Reply[0]; +0x0000 73 1b 00 00 */ /* unsigned char WudfMsg_EXIT_PROCESS_Reply[0]; +0x0000 74 1b 00 00 */ /* unsigned char WudfMsg_MESSAGE_CONTROL_OBJECT_NAME_Reply[0]; +0x0000 75 1b 00 00 */ /* unsigned char WudfMsg_IRP_Reply[0]; +0x0000 76 1b 00 00 */ /* unsigned char WudfMsg_IRP_COMPLETION_Reply[0]; +0x0000 77 1b 00 00 */ /* unsigned char WudfMsg_CLOSE_DEVICE_STACK_Reply[0]; +0x0000 78 1b 00 00 */ /* unsigned char WudfMsg_MESSAGE_QUERY_PROCESS_Reply[0]; +0x0000 f5 13 00 00 */ /* unsigned char WudfMsg_MESSAGE_OPEN_PROCESS_Reply[0]; +0x0000 fa 13 00 00 */ /* unsigned char WudfMsg_MESSAGE_CLOSE_PROCESS_Reply[0]; +0x0000 79 1b 00 00 */ /* unsigned char WudfMsg_CONNECT_Reply[0]; +0x0000 7a 1b 00 00 */ unsigned char WudfMsg_WMI_POWER_DATA_Reply[80]; /* +0x0000 7b 1b 00 00 */ }; struct _s__RTTIBaseClassArray { unsigned char arrayOfBaseClassDescriptors[1]; /* +0x0000 7e 1b 00 00 */ }; struct tagCAPROPVARIANT { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 79 13 00 00 */ }; enum tagShutdownType { IdleShutdown = 0, ForcedShutdown = 1 }; enum tagDOMNodeType { NODE_INVALID = 0, NODE_ELEMENT = 1, NODE_ATTRIBUTE = 2, NODE_TEXT = 3, NODE_CDATA_SECTION = 4, NODE_ENTITY_REFERENCE = 5, NODE_ENTITY = 6, NODE_PROCESSING_INSTRUCTION = 7, NODE_COMMENT = 8, NODE_DOCUMENT = 9, NODE_DOCUMENT_TYPE = 10, NODE_DOCUMENT_FRAGMENT = 11, NODE_NOTATION = 12 }; enum tagBINDSTATUS { BINDSTATUS_FINDINGRESOURCE = 1, BINDSTATUS_CONNECTING = 2, BINDSTATUS_REDIRECTING = 3, BINDSTATUS_BEGINDOWNLOADDATA = 4, BINDSTATUS_DOWNLOADINGDATA = 5, BINDSTATUS_ENDDOWNLOADDATA = 6, BINDSTATUS_BEGINDOWNLOADCOMPONENTS = 7, BINDSTATUS_INSTALLINGCOMPONENTS = 8, BINDSTATUS_ENDDOWNLOADCOMPONENTS = 9, BINDSTATUS_USINGCACHEDCOPY = 10, BINDSTATUS_SENDINGREQUEST = 11, BINDSTATUS_CLASSIDAVAILABLE = 12, BINDSTATUS_MIMETYPEAVAILABLE = 13, BINDSTATUS_CACHEFILENAMEAVAILABLE = 14, BINDSTATUS_BEGINSYNCOPERATION = 15, BINDSTATUS_ENDSYNCOPERATION = 16, BINDSTATUS_BEGINUPLOADDATA = 17, BINDSTATUS_UPLOADINGDATA = 18, BINDSTATUS_ENDUPLOADDATA = 19, BINDSTATUS_PROTOCOLCLASSID = 20, BINDSTATUS_ENCODING = 21, BINDSTATUS_VERIFIEDMIMETYPEAVAILABLE = 22, BINDSTATUS_CLASSINSTALLLOCATION = 23, BINDSTATUS_DECODING = 24, BINDSTATUS_LOADINGMIMEHANDLER = 25, BINDSTATUS_CONTENTDISPOSITIONATTACH = 26, BINDSTATUS_FILTERREPORTMIMETYPE = 27, BINDSTATUS_CLSIDCANINSTANTIATE = 28, BINDSTATUS_IUNKNOWNAVAILABLE = 29, BINDSTATUS_DIRECTBIND = 30, BINDSTATUS_RAWMIMETYPE = 31, BINDSTATUS_PROXYDETECTING = 32, BINDSTATUS_ACCEPTRANGES = 33, BINDSTATUS_COOKIE_SENT = 34, BINDSTATUS_COMPACT_POLICY_RECEIVED = 35, BINDSTATUS_COOKIE_SUPPRESSED = 36, BINDSTATUS_COOKIE_STATE_UNKNOWN = 37, BINDSTATUS_COOKIE_STATE_ACCEPT = 38, BINDSTATUS_COOKIE_STATE_REJECT = 39, BINDSTATUS_COOKIE_STATE_PROMPT = 40, BINDSTATUS_COOKIE_STATE_LEASH = 41, BINDSTATUS_COOKIE_STATE_DOWNGRADE = 42, BINDSTATUS_POLICY_HREF = 43, BINDSTATUS_P3P_HEADER = 44, BINDSTATUS_SESSION_COOKIE_RECEIVED = 45, BINDSTATUS_PERSISTENT_COOKIE_RECEIVED = 46, BINDSTATUS_SESSION_COOKIES_ALLOWED = 47, BINDSTATUS_CACHECONTROL = 48, BINDSTATUS_CONTENTDISPOSITIONFILENAME = 49, BINDSTATUS_MIMETEXTPLAINMISMATCH = 50, BINDSTATUS_PUBLISHERAVAILABLE = 51, BINDSTATUS_DISPLAYNAMEAVAILABLE = 52, BINDSTATUS_SSLUX_NAVBLOCKED = 53, BINDSTATUS_SERVER_MIMETYPEAVAILABLE = 54, BINDSTATUS_SNIFFED_CLASSIDAVAILABLE = 55, BINDSTATUS_64BIT_PROGRESS = 56, BINDSTATUS_LAST = 56, BINDSTATUS_RESERVED_0 = 57, BINDSTATUS_RESERVED_1 = 58, BINDSTATUS_RESERVED_2 = 59, BINDSTATUS_RESERVED_3 = 60, BINDSTATUS_RESERVED_4 = 61, BINDSTATUS_RESERVED_5 = 62, BINDSTATUS_RESERVED_6 = 63, BINDSTATUS_RESERVED_7 = 64, BINDSTATUS_RESERVED_8 = 65, BINDSTATUS_RESERVED_9 = 66, BINDSTATUS_LAST_PRIVATE = 66 }; struct _WDFPROCMGMT_MESSAGE_CONTROL_OBJECT_NAME_REPLY { unsigned char Header[4]; /* +0x0000 eb 13 00 00 */ }; struct _PEB { unsigned char InheritedAddressSpace; /* +0x0000 */ unsigned char ReadImageFileExecOptions; /* +0x0001 */ unsigned char BeingDebugged; /* +0x0002 */ unsigned char BitField; /* +0x0003 */ /* unsigned char ImageUsesLargePages[0]; +0x0003 06 11 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0003 a7 1b 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0003 a8 1b 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0003 a9 1b 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0003 aa 1b 00 00 */ unsigned char SpareBits[1]; /* +0x0003 ab 1b 00 00 */ void *Mutant; /* +0x0004 */ void *ImageBaseAddress; /* +0x0008 */ unsigned char Ldr[4]; /* +0x000c ad 1b 00 00 */ unsigned char ProcessParameters[4]; /* +0x0010 af 1b 00 00 */ void *SubSystemData; /* +0x0014 */ void *ProcessHeap; /* +0x0018 */ unsigned char FastPebLock[4]; /* +0x001c 55 12 00 00 */ void *AtlThunkSListPtr; /* +0x0020 */ void *IFEOKey; /* +0x0024 */ unsigned long CrossProcessFlags; /* +0x0028 */ /* unsigned char ProcessInJob[0]; +0x0028 3b 10 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0028 3c 10 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0028 3d 10 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0028 3e 10 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0028 3f 10 00 00 */ unsigned char ReservedBits0[4]; /* +0x0028 b0 1b 00 00 */ void *KernelCallbackTable; /* +0x002c */ void *UserSharedInfoPtr; /* +0x002c */ unsigned char SystemReserved[4]; /* +0x0030 33 10 00 00 */ unsigned long AtlThunkSListPtr32; /* +0x0034 */ void *ApiSetMap; /* +0x0038 */ unsigned long TlsExpansionCounter; /* +0x003c */ void *TlsBitmap; /* +0x0040 */ unsigned char TlsBitmapBits[8]; /* +0x0044 2c 10 00 00 */ void *ReadOnlySharedMemoryBase; /* +0x004c */ void *HotpatchInformation; /* +0x0050 */ unsigned char ReadOnlyStaticServerData[4]; /* +0x0054 21 10 00 00 */ void *AnsiCodePageData; /* +0x0058 */ void *OemCodePageData; /* +0x005c */ void *UnicodeCaseTableData; /* +0x0060 */ unsigned long NumberOfProcessors; /* +0x0064 */ unsigned long NtGlobalFlag; /* +0x0068 */ unsigned char CriticalSectionTimeout[8]; /* +0x0070 34 10 00 00 */ unsigned long HeapSegmentReserve; /* +0x0078 */ unsigned long HeapSegmentCommit; /* +0x007c */ unsigned long HeapDeCommitTotalFreeThreshold; /* +0x0080 */ unsigned long HeapDeCommitFreeBlockThreshold; /* +0x0084 */ unsigned long NumberOfHeaps; /* +0x0088 */ unsigned long MaximumNumberOfHeaps; /* +0x008c */ unsigned char ProcessHeaps[4]; /* +0x0090 21 10 00 00 */ void *GdiSharedHandleTable; /* +0x0094 */ void *ProcessStarterHelper; /* +0x0098 */ unsigned long GdiDCAttributeList; /* +0x009c */ unsigned char LoaderLock[4]; /* +0x00a0 55 12 00 00 */ unsigned long OSMajorVersion; /* +0x00a4 */ unsigned long OSMinorVersion; /* +0x00a8 */ unsigned short OSBuildNumber; /* +0x00ac */ unsigned short OSCSDVersion; /* +0x00ae */ unsigned long OSPlatformId; /* +0x00b0 */ unsigned long ImageSubsystem; /* +0x00b4 */ unsigned long ImageSubsystemMajorVersion; /* +0x00b8 */ unsigned long ImageSubsystemMinorVersion; /* +0x00bc */ unsigned long ActiveProcessAffinityMask; /* +0x00c0 */ unsigned char GdiHandleBuffer[136]; /* +0x00c4 b1 1b 00 00 */ unsigned char PostProcessInitRoutine[4]; /* +0x014c b2 1b 00 00 */ void *TlsExpansionBitmap; /* +0x0150 */ unsigned char TlsExpansionBitmapBits[128]; /* +0x0154 b3 1b 00 00 */ unsigned long SessionId; /* +0x01d4 */ unsigned char AppCompatFlags[8]; /* +0x01d8 4c 10 00 00 */ unsigned char AppCompatFlagsUser[8]; /* +0x01e0 4c 10 00 00 */ void *pShimData; /* +0x01e8 */ void *AppCompatInfo; /* +0x01ec */ unsigned char CSDVersion[8]; /* +0x01f0 a0 10 00 00 */ unsigned char ActivationContextData[4]; /* +0x01f8 b6 1b 00 00 */ unsigned char ProcessAssemblyStorageMap[4]; /* +0x01fc b8 1b 00 00 */ unsigned char SystemDefaultActivationContextData[4]; /* +0x0200 b6 1b 00 00 */ unsigned char SystemAssemblyStorageMap[4]; /* +0x0204 b8 1b 00 00 */ unsigned long MinimumStackCommit; /* +0x0208 */ unsigned char FlsCallback[4]; /* +0x020c ba 1b 00 00 */ unsigned char FlsListHead[8]; /* +0x0210 80 10 00 00 */ void *FlsBitmap; /* +0x0218 */ unsigned char FlsBitmapBits[16]; /* +0x021c bb 1b 00 00 */ unsigned long FlsHighIndex; /* +0x022c */ void *WerRegistrationData; /* +0x0230 */ void *WerShipAssertPtr; /* +0x0234 */ void *pUnused; /* +0x0238 */ void *pImageHeaderHash; /* +0x023c */ unsigned long TracingFlags; /* +0x0240 */ /* unsigned char HeapTracingEnabled[0]; +0x0240 3b 10 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0240 3c 10 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0240 3d 10 00 00 */ unsigned char SpareTracingBits[8]; /* +0x0240 bc 1b 00 00 */ unsigned long long CsrServerReadOnlySharedMemoryBase; /* +0x0248 */ }; enum _JOBOBJECTINFOCLASS { JobObjectBasicAccountingInformation = 1, JobObjectBasicLimitInformation = 2, JobObjectBasicProcessIdList = 3, JobObjectBasicUIRestrictions = 4, JobObjectSecurityLimitInformation = 5, JobObjectEndOfJobTimeInformation = 6, JobObjectAssociateCompletionPortInformation = 7, JobObjectBasicAndIoAccountingInformation = 8, JobObjectExtendedLimitInformation = 9, JobObjectJobSetInformation = 10, JobObjectGroupInformation = 11, JobObjectNotificationLimitInformation = 12, JobObjectLimitViolationInformation = 13, JobObjectGroupInformationEx = 14, JobObjectCpuRateControlInformation = 15, JobObjectCompletionFilter = 16, JobObjectCompletionCounter = 17, JobObjectFreezeInformation = 18, JobObjectExtendedAccountingInformation = 19, JobObjectWakeInformation = 20, JobObjectIdleAwareInformation = 21, JobObjectSchedulingRankBiasInformation = 22, JobObjectTimerVirtualizationInformation = 23, JobObjectCycleTimeNotification = 24, JobObjectReserved1Information = 18, JobObjectReserved2Information = 19, JobObjectReserved3Information = 20, JobObjectReserved4Information = 21, JobObjectReserved5Information = 22, JobObjectReserved6Information = 23, JobObjectReserved7Information = 24, MaxJobObjectInfoClass = 25 }; struct __MIDL___MIDL_itf_wdfplatform_0000_0000_0004 { void *Reserved; /* +0x0000 */ }; struct tagCAFLT { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 40 04 00 00 */ }; struct _TEB_ACTIVE_FRAME_CONTEXT { unsigned long Flags; /* +0x0000 */ unsigned char FrameName[4]; /* +0x0004 0c 10 00 00 */ }; struct __MIDL___MIDL_itf_wdfplatform_0000_0006_0001 { unsigned char StartNewTraceSession[4]; /* +0x0000 74 00 00 00 */ unsigned char PrivateTrace[4]; /* +0x0004 74 00 00 00 */ unsigned char TruncateExistingLog[4]; /* +0x0008 74 00 00 00 */ unsigned long MaximumLogFileMb; /* +0x000c */ }; struct _XSTATE_CONFIGURATION { unsigned long long EnabledFeatures; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned char OptimizedSave[4]; /* +0x000c 3b 10 00 00 */ unsigned char Features[512]; /* +0x0010 ca 1b 00 00 */ }; struct tagCAH { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 23 12 00 00 */ }; struct tagVersionedStream { unsigned char guidVersion[16]; /* +0x0000 13 10 00 00 */ unsigned char pStream[4]; /* +0x0010 85 13 00 00 */ }; struct $_TypeDescriptor$_extraBytes_19 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[19]; /* +0x0008 d2 1b 00 00 */ }; struct _WUDFMESSAGE_IO_HEADER { unsigned char Header[4]; /* +0x0000 db 13 00 00 */ void *Irp; /* +0x0004 */ unsigned long long RequestId; /* +0x0008 */ unsigned long ProcessId; /* +0x0010 */ unsigned char Is32bitProcess; /* +0x0014 */ char RequestorMode; /* +0x0015 */ unsigned char DirectMappedTransfer; /* +0x0016 */ }; struct tagPROPVARIANT:::: { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ char cVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char hVal[0]; +0x0008 34 10 00 00 */ /* unsigned char uhVal[0]; +0x0008 4c 10 00 00 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 7a 13 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char filetime[0]; +0x0008 e1 12 00 00 */ /* unsigned char puuid[0]; +0x0008 7b 13 00 00 */ /* unsigned char pclipdata[0]; +0x0008 7d 13 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 04 00 00 */ /* unsigned char bstrblobVal[0]; +0x0008 7e 13 00 00 */ /* unsigned char blob[0]; +0x0008 7f 13 00 00 */ char *pszVal; /* +0x0008 */ /* unsigned char pwszVal[0]; +0x0008 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0008 81 13 00 00 */ /* unsigned char pdispVal[0]; +0x0008 83 13 00 00 */ /* unsigned char pStream[0]; +0x0008 85 13 00 00 */ /* unsigned char pStorage[0]; +0x0008 87 13 00 00 */ /* unsigned char pVersionedStream[0]; +0x0008 89 13 00 00 */ /* unsigned char parray[0]; +0x0008 8b 13 00 00 */ /* unsigned char cac[0]; +0x0008 8c 13 00 00 */ /* unsigned char caub[0]; +0x0008 8d 13 00 00 */ /* unsigned char cai[0]; +0x0008 8e 13 00 00 */ /* unsigned char caui[0]; +0x0008 8f 13 00 00 */ /* unsigned char cal[0]; +0x0008 90 13 00 00 */ /* unsigned char caul[0]; +0x0008 91 13 00 00 */ /* unsigned char cah[0]; +0x0008 92 13 00 00 */ /* unsigned char cauh[0]; +0x0008 93 13 00 00 */ /* unsigned char caflt[0]; +0x0008 94 13 00 00 */ /* unsigned char cadbl[0]; +0x0008 95 13 00 00 */ /* unsigned char cabool[0]; +0x0008 96 13 00 00 */ /* unsigned char cascode[0]; +0x0008 97 13 00 00 */ /* unsigned char cacy[0]; +0x0008 98 13 00 00 */ /* unsigned char cadate[0]; +0x0008 99 13 00 00 */ /* unsigned char cafiletime[0]; +0x0008 9a 13 00 00 */ /* unsigned char cauuid[0]; +0x0008 9b 13 00 00 */ /* unsigned char caclipdata[0]; +0x0008 9c 13 00 00 */ /* unsigned char cabstr[0]; +0x0008 9d 13 00 00 */ /* unsigned char cabstrblob[0]; +0x0008 9e 13 00 00 */ /* unsigned char calpstr[0]; +0x0008 9f 13 00 00 */ /* unsigned char calpwstr[0]; +0x0008 a0 13 00 00 */ /* unsigned char capropvar[0]; +0x0008 a1 13 00 00 */ char *pcVal; /* +0x0008 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ long *plVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 04 00 00 */ /* unsigned char pfltVal[0]; +0x0008 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 04 00 00 */ short *pboolVal; /* +0x0008 */ /* unsigned char pdecVal[0]; +0x0008 a3 13 00 00 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 a4 13 00 00 */ /* unsigned char pdate[0]; +0x0008 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e6 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 a5 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 a6 13 00 00 */ /* unsigned char pparray[0]; +0x0008 a7 13 00 00 */ unsigned char pvarVal[8]; /* +0x0008 79 13 00 00 */ }; struct tagPROPVARIANT:::::: { char cVal; /* +0x0000 */ unsigned char bVal; /* +0x0000 */ short iVal; /* +0x0000 */ unsigned short uiVal; /* +0x0000 */ long lVal; /* +0x0000 */ unsigned long ulVal; /* +0x0000 */ /* unsigned char intVal[0]; +0x0000 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0000 75 00 00 00 */ /* unsigned char hVal[0]; +0x0000 34 10 00 00 */ /* unsigned char uhVal[0]; +0x0000 4c 10 00 00 */ /* unsigned char fltVal[0]; +0x0000 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0000 41 00 00 00 */ short boolVal; /* +0x0000 */ long scode; /* +0x0000 */ /* unsigned char cyVal[0]; +0x0000 7a 13 00 00 */ /* unsigned char date[0]; +0x0000 41 00 00 00 */ /* unsigned char filetime[0]; +0x0000 e1 12 00 00 */ /* unsigned char puuid[0]; +0x0000 7b 13 00 00 */ /* unsigned char pclipdata[0]; +0x0000 7d 13 00 00 */ /* unsigned char bstrVal[0]; +0x0000 71 04 00 00 */ /* unsigned char bstrblobVal[0]; +0x0000 7e 13 00 00 */ /* unsigned char blob[0]; +0x0000 7f 13 00 00 */ char *pszVal; /* +0x0000 */ /* unsigned char pwszVal[0]; +0x0000 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0000 81 13 00 00 */ /* unsigned char pdispVal[0]; +0x0000 83 13 00 00 */ /* unsigned char pStream[0]; +0x0000 85 13 00 00 */ /* unsigned char pStorage[0]; +0x0000 87 13 00 00 */ /* unsigned char pVersionedStream[0]; +0x0000 89 13 00 00 */ /* unsigned char parray[0]; +0x0000 8b 13 00 00 */ /* unsigned char cac[0]; +0x0000 8c 13 00 00 */ /* unsigned char caub[0]; +0x0000 8d 13 00 00 */ /* unsigned char cai[0]; +0x0000 8e 13 00 00 */ /* unsigned char caui[0]; +0x0000 8f 13 00 00 */ /* unsigned char cal[0]; +0x0000 90 13 00 00 */ /* unsigned char caul[0]; +0x0000 91 13 00 00 */ /* unsigned char cah[0]; +0x0000 92 13 00 00 */ /* unsigned char cauh[0]; +0x0000 93 13 00 00 */ /* unsigned char caflt[0]; +0x0000 94 13 00 00 */ /* unsigned char cadbl[0]; +0x0000 95 13 00 00 */ /* unsigned char cabool[0]; +0x0000 96 13 00 00 */ /* unsigned char cascode[0]; +0x0000 97 13 00 00 */ /* unsigned char cacy[0]; +0x0000 98 13 00 00 */ /* unsigned char cadate[0]; +0x0000 99 13 00 00 */ /* unsigned char cafiletime[0]; +0x0000 9a 13 00 00 */ /* unsigned char cauuid[0]; +0x0000 9b 13 00 00 */ /* unsigned char caclipdata[0]; +0x0000 9c 13 00 00 */ /* unsigned char cabstr[0]; +0x0000 9d 13 00 00 */ /* unsigned char cabstrblob[0]; +0x0000 9e 13 00 00 */ /* unsigned char calpstr[0]; +0x0000 9f 13 00 00 */ /* unsigned char calpwstr[0]; +0x0000 a0 13 00 00 */ /* unsigned char capropvar[0]; +0x0000 a1 13 00 00 */ char *pcVal; /* +0x0000 */ unsigned char *pbVal; /* +0x0000 */ short *piVal; /* +0x0000 */ unsigned short *puiVal; /* +0x0000 */ long *plVal; /* +0x0000 */ unsigned long *pulVal; /* +0x0000 */ /* unsigned char pintVal[0]; +0x0000 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0000 75 04 00 00 */ /* unsigned char pfltVal[0]; +0x0000 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0000 41 04 00 00 */ short *pboolVal; /* +0x0000 */ /* unsigned char pdecVal[0]; +0x0000 a3 13 00 00 */ long *pscode; /* +0x0000 */ /* unsigned char pcyVal[0]; +0x0000 a4 13 00 00 */ /* unsigned char pdate[0]; +0x0000 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0000 e6 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0000 a5 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0000 a6 13 00 00 */ /* unsigned char pparray[0]; +0x0000 a7 13 00 00 */ unsigned char pvarVal[8]; /* +0x0000 79 13 00 00 */ }; struct _OVERLAPPED { unsigned long Internal; /* +0x0000 */ unsigned long InternalHigh; /* +0x0004 */ unsigned long Offset; /* +0x0008 */ unsigned long OffsetHigh; /* +0x000c */ void *Pointer; /* +0x0008 */ void *hEvent; /* +0x0010 */ }; struct tagLC_ID { unsigned short wLanguage; /* +0x0000 */ unsigned short wCountry; /* +0x0002 */ unsigned short wCodePage; /* +0x0004 */ }; struct _WUDFMESSAGE_CONNECT_REPLY { unsigned char Header[4]; /* +0x0000 eb 13 00 00 */ void *ProcessId; /* +0x0004 */ }; struct _GDI_TEB_BATCH { unsigned long Offset; /* +0x0000 */ unsigned long HDC; /* +0x0004 */ unsigned char Buffer[1240]; /* +0x0008 13 1c 00 00 */ }; enum tagINVOKEKIND { INVOKE_FUNC = 1, INVOKE_PROPERTYGET = 2, INVOKE_PROPERTYPUT = 4, INVOKE_PROPERTYPUTREF = 8 }; struct tagCALPSTR { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 eb 10 00 00 */ }; struct _TypeDescriptor { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ /* unsigned char name[0]; +0x0008 5c 1c 00 00 */ }; struct $_TypeDescriptor$_extraBytes_21 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[21]; /* +0x0008 60 1c 00 00 */ }; struct $_TypeDescriptor$_extraBytes_39 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[39]; /* +0x0008 64 1c 00 00 */ }; struct _XSTATE_FEATURE { unsigned long Offset; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct tagCACY { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 a4 13 00 00 */ }; struct _OVERLAPPED:: { unsigned long Offset; /* +0x0000 */ unsigned long OffsetHigh; /* +0x0004 */ void *Pointer; /* +0x0000 */ }; struct _OVERLAPPED:::: { unsigned long Offset; /* +0x0000 */ unsigned long OffsetHigh; /* +0x0004 */ }; struct tagVS_FIXEDFILEINFO { unsigned long dwSignature; /* +0x0000 */ unsigned long dwStrucVersion; /* +0x0004 */ unsigned long dwFileVersionMS; /* +0x0008 */ unsigned long dwFileVersionLS; /* +0x000c */ unsigned long dwProductVersionMS; /* +0x0010 */ unsigned long dwProductVersionLS; /* +0x0014 */ unsigned long dwFileFlagsMask; /* +0x0018 */ unsigned long dwFileFlags; /* +0x001c */ unsigned long dwFileOS; /* +0x0020 */ unsigned long dwFileType; /* +0x0024 */ unsigned long dwFileSubtype; /* +0x0028 */ unsigned long dwFileDateMS; /* +0x002c */ unsigned long dwFileDateLS; /* +0x0030 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_8 { unsigned char arrayOfBaseClassDescriptors[9]; /* +0x0000 76 1c 00 00 */ }; struct WER_REPORT_DESCRIPTOR { unsigned char Problem[4]; /* +0x0000 10 10 00 00 */ unsigned char Summary[4]; /* +0x0004 10 10 00 00 */ unsigned char Description[4]; /* +0x0008 10 10 00 00 */ unsigned char DumpHeap[4]; /* +0x000c 30 00 00 00 */ }; struct tagCAUI { unsigned long cElems; /* +0x0000 */ unsigned short *pElems; /* +0x0004 */ }; struct _EXCEPTION_POINTERS { unsigned char ExceptionRecord[4]; /* +0x0000 aa 1c 00 00 */ unsigned char ContextRecord[4]; /* +0x0004 66 18 00 00 */ }; struct _RTL_CRITICAL_SECTION_DEBUG { unsigned short Type; /* +0x0000 */ unsigned short CreatorBackTraceIndex; /* +0x0002 */ unsigned char CriticalSection[4]; /* +0x0004 55 12 00 00 */ unsigned char ProcessLocksList[8]; /* +0x0008 80 10 00 00 */ unsigned long EntryCount; /* +0x0010 */ unsigned long ContentionCount; /* +0x0014 */ unsigned long Flags; /* +0x0018 */ unsigned short CreatorBackTraceIndexHigh; /* +0x001c */ unsigned short SpareUSHORT; /* +0x001e */ }; struct tagSAFEARRAY { unsigned short cDims; /* +0x0000 */ unsigned short fFeatures; /* +0x0002 */ unsigned long cbElements; /* +0x0004 */ unsigned long cLocks; /* +0x0008 */ void *pvData; /* +0x000c */ unsigned char rgsabound[8]; /* +0x0010 b0 1c 00 00 */ }; enum _IRP_HANDLING_FLAG { IRP_HANDLING__COMPLETE = 0, IRP_HANDLING__FORWARD = 1, IRP_HANDLING__MAX = 2 }; struct _WUDFMESSAGE_IRP_REPLY { unsigned char Header[4]; /* +0x0000 eb 13 00 00 */ unsigned long Information; /* +0x0004 */ unsigned char Parameters[64]; /* +0x0008 b4 1c 00 00 */ unsigned char IrpHandling[4]; /* +0x0048 b6 1c 00 00 */ unsigned char CompletionContext[4]; /* +0x004c b8 1c 00 00 */ }; enum CWMO_FLAGS { CWMO_DISPATCH_CALLS = 1, CWMO_DISPATCH_WINDOW_MESSAGES = 2, REAL_CWMO_ENABLE_CALL_REENTRANCY = 1, CWMO_ENABLE_WINDOW_MESSAGES = 2, CWMO_ENABLE_CALL_REENTRANCY = 3 }; struct _EXCEPTION_RECORD { long ExceptionCode; /* +0x0000 */ unsigned long ExceptionFlags; /* +0x0004 */ unsigned char ExceptionRecord[4]; /* +0x0008 aa 1c 00 00 */ void *ExceptionAddress; /* +0x000c */ unsigned long NumberParameters; /* +0x0010 */ unsigned char ExceptionInformation[60]; /* +0x0014 be 1c 00 00 */ }; enum _tagPSUACTION { PSU_DEFAULT = 1, PSU_SECURITY_URL_ONLY = 2 }; enum _WUDF_IRP_BUFFER_INDEX { IrpBufferIndexPrimary = 0, IrpBufferIndexSecondary = 1, IrpBufferIndexMax = 2 }; struct _ALPC_CONTEXT_ATTR { void *PortContext; /* +0x0000 */ void *MessageContext; /* +0x0004 */ unsigned long Sequence; /* +0x0008 */ unsigned long MessageId; /* +0x000c */ unsigned long CallbackId; /* +0x0010 */ }; struct CPlatform:: { unsigned char Initialized[4]; /* +0x0000 30 00 00 00 */ unsigned char Settings[16]; /* +0x0004 79 18 00 00 */ unsigned char StackTracker[4]; /* +0x0014 12 1a 00 00 */ }; struct _WUDFMESSAGE_CREATE_REPLY { unsigned char Header[4]; /* +0x0000 eb 13 00 00 */ unsigned char CreateContext[4]; /* +0x0004 e7 13 00 00 */ }; enum tagGLOBALOPT_EH_VALUES { COMGLB_EXCEPTION_HANDLE = 0, COMGLB_EXCEPTION_DONOT_HANDLE_FATAL = 1, COMGLB_EXCEPTION_DONOT_HANDLE = 1, COMGLB_EXCEPTION_DONOT_HANDLE_ANY = 2 }; enum __MIDL_IUri_0002 { Uri_HOST_UNKNOWN = 0, Uri_HOST_DNS = 1, Uri_HOST_IPV4 = 2, Uri_HOST_IPV6 = 3, Uri_HOST_IDN = 4 }; struct _PORT_MESSAGE:::: { short Type; /* +0x0000 */ short DataInfoOffset; /* +0x0002 */ }; struct _PORT_MESSAGE:: { /* unsigned char ClientId[0]; +0x0000 93 10 00 00 */ unsigned char DoNotUseThisField[8]; /* +0x0000 41 00 00 00 */ }; struct _PORT_MESSAGE:: { unsigned long ClientViewSize; /* +0x0000 */ unsigned long CallbackId; /* +0x0000 */ }; struct tagSTATSTG { unsigned char pwcsName[4]; /* +0x0000 71 04 00 00 */ unsigned long type; /* +0x0004 */ unsigned char cbSize[8]; /* +0x0008 4c 10 00 00 */ unsigned char mtime[8]; /* +0x0010 e1 12 00 00 */ unsigned char ctime[8]; /* +0x0018 e1 12 00 00 */ unsigned char atime[8]; /* +0x0020 e1 12 00 00 */ unsigned long grfMode; /* +0x0028 */ unsigned long grfLocksSupported; /* +0x002c */ unsigned char clsid[16]; /* +0x0030 13 10 00 00 */ unsigned long grfStateBits; /* +0x0040 */ unsigned long reserved; /* +0x0044 */ }; enum _MEMORY_CACHING_TYPE_ORIG { MmFrameBufferCached = 2 }; struct $_s__RTTIBaseClassArray$_extraBytes_52 { unsigned char arrayOfBaseClassDescriptors[53]; /* +0x0000 e0 1c 00 00 */ }; enum _EXCEPTION_DISPOSITION { ExceptionContinueExecution = 0, ExceptionContinueSearch = 1, ExceptionNestedException = 2, ExceptionCollidedUnwind = 3 }; struct _EXCEPTION_REGISTRATION_RECORD { unsigned char Next[4]; /* +0x0000 24 1b 00 00 */ unsigned char Handler[4]; /* +0x0004 e7 1c 00 00 */ }; struct $_TypeDescriptor$_extraBytes_23 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[23]; /* +0x0008 eb 1c 00 00 */ }; struct tagDISPPARAMS { unsigned char rgvarg[4]; /* +0x0000 ab 13 00 00 */ long *rgdispidNamedArgs; /* +0x0004 */ unsigned char cArgs[4]; /* +0x0008 75 00 00 00 */ unsigned char cNamedArgs[4]; /* +0x000c 75 00 00 00 */ }; enum _KSPIN_LOCK_QUEUE_NUMBER { LockQueueUnusedSpare0 = 0, LockQueueExpansionLock = 1, LockQueueUnusedSpare2 = 2, LockQueueSystemSpaceLock = 3, LockQueueVacbLock = 4, LockQueueMasterLock = 5, LockQueueNonPagedPoolLock = 6, LockQueueIoCancelLock = 7, LockQueueWorkQueueLock = 8, LockQueueIoVpbLock = 9, LockQueueIoDatabaseLock = 10, LockQueueIoCompletionLock = 11, LockQueueNtfsStructLock = 12, LockQueueAfdWorkQueueLock = 13, LockQueueBcbLock = 14, LockQueueMmNonPagedPoolLock = 15, LockQueueUnusedSpare16 = 16, LockQueueMaximumLock = 17 }; enum _SYSTEM_POWER_STATE { PowerSystemUnspecified = 0, PowerSystemWorking = 1, PowerSystemSleeping1 = 2, PowerSystemSleeping2 = 3, PowerSystemSleeping3 = 4, PowerSystemHibernate = 5, PowerSystemShutdown = 6, PowerSystemMaximum = 7 }; struct _POWER_STATE { /* unsigned char SystemState[0]; +0x0000 f4 1c 00 00 */ unsigned char DeviceState[4]; /* +0x0000 f7 11 00 00 */ }; struct _CONTEXT { unsigned long ContextFlags; /* +0x0000 */ unsigned long Dr0; /* +0x0004 */ unsigned long Dr1; /* +0x0008 */ unsigned long Dr2; /* +0x000c */ unsigned long Dr3; /* +0x0010 */ unsigned long Dr6; /* +0x0014 */ unsigned long Dr7; /* +0x0018 */ unsigned char FloatSave[112]; /* +0x001c f7 1c 00 00 */ unsigned long SegGs; /* +0x008c */ unsigned long SegFs; /* +0x0090 */ unsigned long SegEs; /* +0x0094 */ unsigned long SegDs; /* +0x0098 */ unsigned long Edi; /* +0x009c */ unsigned long Esi; /* +0x00a0 */ unsigned long Ebx; /* +0x00a4 */ unsigned long Edx; /* +0x00a8 */ unsigned long Ecx; /* +0x00ac */ unsigned long Eax; /* +0x00b0 */ unsigned long Ebp; /* +0x00b4 */ unsigned long Eip; /* +0x00b8 */ unsigned long SegCs; /* +0x00bc */ unsigned long EFlags; /* +0x00c0 */ unsigned long Esp; /* +0x00c4 */ unsigned long SegSs; /* +0x00c8 */ unsigned char ExtendedRegisters[512]; /* +0x00cc f8 1c 00 00 */ }; struct _WUDFMESSAGE_ADD_DEVICE_REPLY { unsigned char Header[4]; /* +0x0000 eb 13 00 00 */ unsigned char DeferBufferRetrieval; /* +0x0004 */ unsigned char DirectIoForReadWrite; /* +0x0005 */ unsigned char DirectIoForIoctl; /* +0x0006 */ }; struct tagCAFILETIME { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 e2 12 00 00 */ }; struct _IMAGE_OPTIONAL_HEADER { unsigned short Magic; /* +0x0000 */ unsigned char MajorLinkerVersion; /* +0x0002 */ unsigned char MinorLinkerVersion; /* +0x0003 */ unsigned long SizeOfCode; /* +0x0004 */ unsigned long SizeOfInitializedData; /* +0x0008 */ unsigned long SizeOfUninitializedData; /* +0x000c */ unsigned long AddressOfEntryPoint; /* +0x0010 */ unsigned long BaseOfCode; /* +0x0014 */ unsigned long BaseOfData; /* +0x0018 */ unsigned long ImageBase; /* +0x001c */ unsigned long SectionAlignment; /* +0x0020 */ unsigned long FileAlignment; /* +0x0024 */ unsigned short MajorOperatingSystemVersion; /* +0x0028 */ unsigned short MinorOperatingSystemVersion; /* +0x002a */ unsigned short MajorImageVersion; /* +0x002c */ unsigned short MinorImageVersion; /* +0x002e */ unsigned short MajorSubsystemVersion; /* +0x0030 */ unsigned short MinorSubsystemVersion; /* +0x0032 */ unsigned long Win32VersionValue; /* +0x0034 */ unsigned long SizeOfImage; /* +0x0038 */ unsigned long SizeOfHeaders; /* +0x003c */ unsigned long CheckSum; /* +0x0040 */ unsigned short Subsystem; /* +0x0044 */ unsigned short DllCharacteristics; /* +0x0046 */ unsigned long SizeOfStackReserve; /* +0x0048 */ unsigned long SizeOfStackCommit; /* +0x004c */ unsigned long SizeOfHeapReserve; /* +0x0050 */ unsigned long SizeOfHeapCommit; /* +0x0054 */ unsigned long LoaderFlags; /* +0x0058 */ unsigned long NumberOfRvaAndSizes; /* +0x005c */ unsigned char DataDirectory[128]; /* +0x0060 00 1d 00 00 */ }; struct _PEB:: { unsigned char BitField; /* +0x0000 */ /* unsigned char ImageUsesLargePages[0]; +0x0000 06 11 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0000 a7 1b 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0000 a8 1b 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0000 a9 1b 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0000 aa 1b 00 00 */ unsigned char SpareBits[1]; /* +0x0000 ab 1b 00 00 */ }; struct _PEB:::: { /* unsigned char ImageUsesLargePages[0]; +0x0000 06 11 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0000 a7 1b 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0000 a8 1b 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0000 a9 1b 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0000 aa 1b 00 00 */ unsigned char SpareBits[1]; /* +0x0000 ab 1b 00 00 */ }; struct _PEB:: { unsigned long CrossProcessFlags; /* +0x0000 */ /* unsigned char ProcessInJob[0]; +0x0000 3b 10 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0000 3c 10 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0000 3d 10 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0000 3e 10 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0000 3f 10 00 00 */ unsigned char ReservedBits0[4]; /* +0x0000 b0 1b 00 00 */ }; struct _PEB:::: { /* unsigned char ProcessInJob[0]; +0x0000 3b 10 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0000 3c 10 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0000 3d 10 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0000 3e 10 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0000 3f 10 00 00 */ unsigned char ReservedBits0[4]; /* +0x0000 b0 1b 00 00 */ }; struct _PEB:: { void *KernelCallbackTable; /* +0x0000 */ void *UserSharedInfoPtr; /* +0x0000 */ }; struct _PEB:: { unsigned long TracingFlags; /* +0x0000 */ /* unsigned char HeapTracingEnabled[0]; +0x0000 3b 10 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0000 3c 10 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0000 3d 10 00 00 */ unsigned char SpareTracingBits[4]; /* +0x0000 bc 1b 00 00 */ }; struct _PEB:::: { /* unsigned char HeapTracingEnabled[0]; +0x0000 3b 10 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0000 3c 10 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0000 3d 10 00 00 */ unsigned char SpareTracingBits[4]; /* +0x0000 bc 1b 00 00 */ }; struct _ALPC_DATA_VIEW_ATTR { unsigned long Flags; /* +0x0000 */ void *SectionHandle; /* +0x0004 */ void *ViewBase; /* +0x0008 */ unsigned long ViewSize; /* +0x000c */ }; struct _PROCESSOR_NUMBER { unsigned short Group; /* +0x0000 */ unsigned char Number; /* +0x0002 */ unsigned char Reserved; /* +0x0003 */ }; enum _WUDF_BREAK_POINT_TYPE { WudfUserBreakin = 1, WudfKernelBreakin = 2, WudfUserOrKernelBreakin = 3 }; struct _WUDFMESSAGE_WMI_POWER_DATA_REPLY { unsigned char Header[4]; /* +0x0000 eb 13 00 00 */ unsigned char QueryResult; /* +0x0004 */ }; struct _EVENT_TRACE_HEADER:: { unsigned short FieldTypeFlags; /* +0x0000 */ unsigned char HeaderType; /* +0x0000 */ unsigned char MarkerFlags; /* +0x0001 */ }; struct _EVENT_TRACE_HEADER:::: { unsigned char HeaderType; /* +0x0000 */ unsigned char MarkerFlags; /* +0x0001 */ }; struct _EVENT_TRACE_HEADER:: { unsigned long Version; /* +0x0000 */ }; struct _EVENT_TRACE_HEADER:: { /* unsigned char Guid[0]; +0x0000 13 10 00 00 */ unsigned long long GuidPtr; /* +0x0000 */ }; struct _EVENT_TRACE_HEADER:: { unsigned long KernelTime; /* +0x0000 */ unsigned long UserTime; /* +0x0004 */ unsigned long long ProcessorTime; /* +0x0000 */ unsigned long ClientContext; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ }; struct _EVENT_TRACE_HEADER:::: { unsigned long KernelTime; /* +0x0000 */ unsigned long UserTime; /* +0x0004 */ }; struct _EVENT_TRACE_HEADER:::: { unsigned long ClientContext; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ }; struct __MIDL___MIDL_itf_wdfplatform_0000_0000_0001 { void *DllBase; /* +0x0000 */ void *EntryPoint; /* +0x0004 */ unsigned long SizeOfImage; /* +0x0008 */ unsigned char ModuleHandle[4]; /* +0x000c 28 12 00 00 */ unsigned char IsWudfComponent[4]; /* +0x0010 74 00 00 00 */ unsigned char FullModuleName[4]; /* +0x0014 71 04 00 00 */ unsigned char BaseModuleName[4]; /* +0x0018 71 04 00 00 */ }; struct $_TypeDescriptor$_extraBytes_20 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[20]; /* +0x0008 55 1d 00 00 */ }; struct $_TypeDescriptor$_extraBytes_17 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[17]; /* +0x0008 5b 1d 00 00 */ }; struct _WUDFMESSAGE_CREATE_DEVICE_STACK_REPLY { unsigned char Header[4]; /* +0x0000 eb 13 00 00 */ unsigned char DevnodeContext[4]; /* +0x0004 de 13 00 00 */ }; struct tagVARIANT:::: { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ long long llVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 7a 13 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0008 81 13 00 00 */ /* unsigned char pdispVal[0]; +0x0008 83 13 00 00 */ /* unsigned char parray[0]; +0x0008 8b 13 00 00 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ long *plVal; /* +0x0008 */ long long *pllVal; /* +0x0008 */ /* unsigned char pfltVal[0]; +0x0008 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 04 00 00 */ short *pboolVal; /* +0x0008 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 a4 13 00 00 */ /* unsigned char pdate[0]; +0x0008 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e6 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 a5 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 a6 13 00 00 */ /* unsigned char pparray[0]; +0x0008 a7 13 00 00 */ /* unsigned char pvarVal[0]; +0x0008 ab 13 00 00 */ void *byref; /* +0x0008 */ char cVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ unsigned long long ullVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char pdecVal[0]; +0x0008 a3 13 00 00 */ char *pcVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ unsigned long long *pullVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 04 00 00 */ void *pvRecord; /* +0x0008 */ unsigned char pRecInfo[4]; /* +0x000c af 13 00 00 */ }; struct tagVARIANT:::::: { long long llVal; /* +0x0000 */ long lVal; /* +0x0000 */ unsigned char bVal; /* +0x0000 */ short iVal; /* +0x0000 */ /* unsigned char fltVal[0]; +0x0000 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0000 41 00 00 00 */ short boolVal; /* +0x0000 */ long scode; /* +0x0000 */ /* unsigned char cyVal[0]; +0x0000 7a 13 00 00 */ /* unsigned char date[0]; +0x0000 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0000 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0000 81 13 00 00 */ /* unsigned char pdispVal[0]; +0x0000 83 13 00 00 */ /* unsigned char parray[0]; +0x0000 8b 13 00 00 */ unsigned char *pbVal; /* +0x0000 */ short *piVal; /* +0x0000 */ long *plVal; /* +0x0000 */ long long *pllVal; /* +0x0000 */ /* unsigned char pfltVal[0]; +0x0000 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0000 41 04 00 00 */ short *pboolVal; /* +0x0000 */ long *pscode; /* +0x0000 */ /* unsigned char pcyVal[0]; +0x0000 a4 13 00 00 */ /* unsigned char pdate[0]; +0x0000 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0000 e6 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0000 a5 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0000 a6 13 00 00 */ /* unsigned char pparray[0]; +0x0000 a7 13 00 00 */ /* unsigned char pvarVal[0]; +0x0000 ab 13 00 00 */ void *byref; /* +0x0000 */ char cVal; /* +0x0000 */ unsigned short uiVal; /* +0x0000 */ unsigned long ulVal; /* +0x0000 */ unsigned long long ullVal; /* +0x0000 */ /* unsigned char intVal[0]; +0x0000 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0000 75 00 00 00 */ /* unsigned char pdecVal[0]; +0x0000 a3 13 00 00 */ char *pcVal; /* +0x0000 */ unsigned short *puiVal; /* +0x0000 */ unsigned long *pulVal; /* +0x0000 */ unsigned long long *pullVal; /* +0x0000 */ /* unsigned char pintVal[0]; +0x0000 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0000 75 04 00 00 */ void *pvRecord; /* +0x0000 */ unsigned char pRecInfo[4]; /* +0x0004 af 13 00 00 */ }; struct tagVARIANT:::::::: { void *pvRecord; /* +0x0000 */ unsigned char pRecInfo[4]; /* +0x0004 af 13 00 00 */ }; enum tagTYPEKIND { TKIND_ENUM = 0, TKIND_RECORD = 1, TKIND_MODULE = 2, TKIND_INTERFACE = 3, TKIND_DISPATCH = 4, TKIND_COCLASS = 5, TKIND_ALIAS = 6, TKIND_UNION = 7, TKIND_MAX = 8 }; struct tagTYPEATTR { unsigned char guid[16]; /* +0x0000 13 10 00 00 */ unsigned long lcid; /* +0x0010 */ unsigned long dwReserved; /* +0x0014 */ long memidConstructor; /* +0x0018 */ long memidDestructor; /* +0x001c */ unsigned char lpstrSchema[4]; /* +0x0020 71 04 00 00 */ unsigned long cbSizeInstance; /* +0x0024 */ unsigned char typekind[4]; /* +0x0028 6e 1d 00 00 */ unsigned short cFuncs; /* +0x002c */ unsigned short cVars; /* +0x002e */ unsigned short cImplTypes; /* +0x0030 */ unsigned short cbSizeVft; /* +0x0032 */ unsigned short cbAlignment; /* +0x0034 */ unsigned short wTypeFlags; /* +0x0036 */ unsigned short wMajorVerNum; /* +0x0038 */ unsigned short wMinorVerNum; /* +0x003a */ unsigned char tdescAlias[8]; /* +0x003c 6f 1d 00 00 */ unsigned char idldescType[8]; /* +0x0044 70 1d 00 00 */ }; struct tagCLIPDATA { unsigned long cbSize; /* +0x0000 */ long ulClipFmt; /* +0x0004 */ unsigned char *pClipData; /* +0x0008 */ }; struct threadlocaleinfostruct:: { char *locale; /* +0x0000 */ unsigned char wlocale[4]; /* +0x0004 71 04 00 00 */ unsigned char refcount[4]; /* +0x0008 74 04 00 00 */ unsigned char wrefcount[4]; /* +0x000c 74 04 00 00 */ }; struct _WUDFMESSAGE_IRP_COMPLETION_REPLY { unsigned char Header[4]; /* +0x0000 eb 13 00 00 */ unsigned long Information; /* +0x0004 */ unsigned char Parameters[64]; /* +0x0008 b4 1c 00 00 */ }; struct tagDEC { unsigned short wReserved; /* +0x0000 */ unsigned char scale; /* +0x0002 */ unsigned char sign; /* +0x0003 */ unsigned short signscale; /* +0x0002 */ unsigned long Hi32; /* +0x0004 */ unsigned long Lo32; /* +0x0008 */ unsigned long Mid32; /* +0x000c */ unsigned long long Lo64; /* +0x0008 */ }; struct tagDEC:: { unsigned char scale; /* +0x0000 */ unsigned char sign; /* +0x0001 */ unsigned short signscale; /* +0x0000 */ }; struct tagDEC:::: { unsigned char scale; /* +0x0000 */ unsigned char sign; /* +0x0001 */ }; struct tagDEC:: { unsigned long Lo32; /* +0x0000 */ unsigned long Mid32; /* +0x0004 */ unsigned long long Lo64; /* +0x0000 */ }; struct tagDEC:::: { unsigned long Lo32; /* +0x0000 */ unsigned long Mid32; /* +0x0004 */ }; struct _WUDFLPC_GET_MESSAGE { void *ReceiverViewBase; /* +0x0000 */ }; enum tagSYSKIND { SYS_WIN16 = 0, SYS_WIN32 = 1, SYS_MAC = 2, SYS_WIN64 = 3 }; struct tagTLIBATTR { unsigned char guid[16]; /* +0x0000 13 10 00 00 */ unsigned long lcid; /* +0x0010 */ unsigned char syskind[4]; /* +0x0014 bb 1d 00 00 */ unsigned short wMajorVerNum; /* +0x0018 */ unsigned short wMinorVerNum; /* +0x001a */ unsigned short wLibFlags; /* +0x001c */ }; struct tagBSTRBLOB { unsigned long cbSize; /* +0x0000 */ unsigned char *pData; /* +0x0004 */ }; struct $_TypeDescriptor$_extraBytes_38 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[38]; /* +0x0008 c1 1d 00 00 */ }; struct _RTL_USER_PROCESS_PARAMETERS { unsigned long MaximumLength; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ unsigned long DebugFlags; /* +0x000c */ void *ConsoleHandle; /* +0x0010 */ unsigned long ConsoleFlags; /* +0x0014 */ void *StandardInput; /* +0x0018 */ void *StandardOutput; /* +0x001c */ void *StandardError; /* +0x0020 */ unsigned char CurrentDirectory[12]; /* +0x0024 c4 1d 00 00 */ unsigned char DllPath[8]; /* +0x0030 a0 10 00 00 */ unsigned char ImagePathName[8]; /* +0x0038 a0 10 00 00 */ unsigned char CommandLine[8]; /* +0x0040 a0 10 00 00 */ void *Environment; /* +0x0048 */ unsigned long StartingX; /* +0x004c */ unsigned long StartingY; /* +0x0050 */ unsigned long CountX; /* +0x0054 */ unsigned long CountY; /* +0x0058 */ unsigned long CountCharsX; /* +0x005c */ unsigned long CountCharsY; /* +0x0060 */ unsigned long FillAttribute; /* +0x0064 */ unsigned long WindowFlags; /* +0x0068 */ unsigned long ShowWindowFlags; /* +0x006c */ unsigned char WindowTitle[8]; /* +0x0070 a0 10 00 00 */ unsigned char DesktopInfo[8]; /* +0x0078 a0 10 00 00 */ unsigned char ShellInfo[8]; /* +0x0080 a0 10 00 00 */ unsigned char RuntimeData[8]; /* +0x0088 a0 10 00 00 */ unsigned char CurrentDirectores[512]; /* +0x0090 c6 1d 00 00 */ unsigned char EnvironmentSize[4]; /* +0x0290 27 10 00 00 */ unsigned char EnvironmentVersion[4]; /* +0x0294 27 10 00 00 */ unsigned char PackageMoniker[8]; /* +0x0298 a0 10 00 00 */ void *PackageDependencyData; /* +0x02a0 */ unsigned long ProcessGroupId; /* +0x02a4 */ }; enum _URLZONEREG { URLZONEREG_DEFAULT = 0, URLZONEREG_HKLM = 1, URLZONEREG_HKCU = 2 }; struct $_TypeDescriptor$_extraBytes_27 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[27]; /* +0x0008 cc 1d 00 00 */ }; struct _WUDFLPC_GET_MESSAGE:: { unsigned char MessageHeader[24]; /* +0x0000 1f 15 00 00 */ /* unsigned char WudfMessage[0]; +0x0018 cf 1d 00 00 */ unsigned char WudfReplyMessage[88]; /* +0x0018 52 16 00 00 */ }; struct _WUDFLPC_GET_MESSAGE:::: { /* unsigned char WudfMessage[0]; +0x0000 cf 1d 00 00 */ unsigned char WudfReplyMessage[88]; /* +0x0000 52 16 00 00 */ }; enum tagFUNCKIND { FUNC_VIRTUAL = 0, FUNC_PUREVIRTUAL = 1, FUNC_NONVIRTUAL = 2, FUNC_STATIC = 3, FUNC_DISPATCH = 4 }; struct tagCAUB { unsigned long cElems; /* +0x0000 */ unsigned char *pElems; /* +0x0004 */ }; struct _CLIENT_ID { void *UniqueProcess; /* +0x0000 */ void *UniqueThread; /* +0x0004 */ }; enum VARENUM { VT_EMPTY = 0, VT_NULL = 1, VT_I2 = 2, VT_I4 = 3, VT_R4 = 4, VT_R8 = 5, VT_CY = 6, VT_DATE = 7, VT_BSTR = 8, VT_DISPATCH = 9, VT_ERROR = 10, VT_BOOL = 11, VT_VARIANT = 12, VT_UNKNOWN = 13, VT_DECIMAL = 14, VT_I1 = 16, VT_UI1 = 17, VT_UI2 = 18, VT_UI4 = 19, VT_I8 = 20, VT_UI8 = 21, VT_INT = 22, VT_UINT = 23, VT_VOID = 24, VT_HRESULT = 25, VT_PTR = 26, VT_SAFEARRAY = 27, VT_CARRAY = 28, VT_USERDEFINED = 29, VT_LPSTR = 30, VT_LPWSTR = 31, VT_RECORD = 36, VT_INT_PTR = 37, VT_UINT_PTR = 38, VT_FILETIME = 64, VT_BLOB = 65, VT_STREAM = 66, VT_STORAGE = 67, VT_STREAMED_OBJECT = 68, VT_STORED_OBJECT = 69, VT_BLOB_OBJECT = 70, VT_CF = 71, VT_CLSID = 72, VT_VERSIONED_STREAM = 73, VT_BSTR_BLOB = 4095, VT_VECTOR = 4096, VT_ARRAY = 8192, VT_BYREF = 16384, = 32770 }; struct _LDR_DATA_TABLE_ENTRY { unsigned char InLoadOrderLinks[8]; /* +0x0000 80 10 00 00 */ unsigned char InMemoryOrderLinks[8]; /* +0x0008 80 10 00 00 */ /* unsigned char InInitializationOrderLinks[0]; +0x0010 80 10 00 00 */ unsigned char InProgressLinks[8]; /* +0x0010 80 10 00 00 */ void *DllBase; /* +0x0018 */ void *EntryPoint; /* +0x001c */ unsigned long SizeOfImage; /* +0x0020 */ unsigned char FullDllName[8]; /* +0x0024 a0 10 00 00 */ unsigned char BaseDllName[8]; /* +0x002c a0 10 00 00 */ /* unsigned char FlagGroup[0]; +0x0034 de 1d 00 00 */ unsigned long Flags; /* +0x0034 */ /* unsigned char PackagedBinary[0]; +0x0034 3b 10 00 00 */ /* unsigned char MarkedForRemoval[0]; +0x0034 3c 10 00 00 */ /* unsigned char ImageDll[0]; +0x0034 3d 10 00 00 */ /* unsigned char LoadNotificationsSent[0]; +0x0034 3e 10 00 00 */ /* unsigned char TelemetryEntryProcessed[0]; +0x0034 3f 10 00 00 */ /* unsigned char ProcessStaticImport[0]; +0x0034 40 10 00 00 */ /* unsigned char InLegacyLists[0]; +0x0034 41 10 00 00 */ /* unsigned char InIndexes[0]; +0x0034 df 1d 00 00 */ /* unsigned char ShimDll[0]; +0x0034 e0 1d 00 00 */ /* unsigned char InExceptionTable[0]; +0x0034 e1 1d 00 00 */ /* unsigned char ReservedFlags1[0]; +0x0034 e2 1d 00 00 */ /* unsigned char LoadInProgress[0]; +0x0034 e3 1d 00 00 */ /* unsigned char ReservedFlags2[0]; +0x0034 e4 1d 00 00 */ /* unsigned char EntryProcessed[0]; +0x0034 e5 1d 00 00 */ /* unsigned char ReservedFlags3[0]; +0x0034 e6 1d 00 00 */ /* unsigned char DontCallForThreads[0]; +0x0034 e7 1d 00 00 */ /* unsigned char ProcessAttachCalled[0]; +0x0034 e8 1d 00 00 */ /* unsigned char ProcessAttachFailed[0]; +0x0034 e9 1d 00 00 */ /* unsigned char CorDeferredValidate[0]; +0x0034 ea 1d 00 00 */ /* unsigned char CorImage[0]; +0x0034 eb 1d 00 00 */ /* unsigned char DontRelocate[0]; +0x0034 ec 1d 00 00 */ /* unsigned char CorILOnly[0]; +0x0034 ed 1d 00 00 */ /* unsigned char ReservedFlags5[0]; +0x0034 ee 1d 00 00 */ /* unsigned char Redirected[0]; +0x0034 ef 1d 00 00 */ /* unsigned char ReservedFlags6[0]; +0x0034 f0 1d 00 00 */ unsigned char CompatDatabaseProcessed[4]; /* +0x0034 f1 1d 00 00 */ unsigned short ObsoleteLoadCount; /* +0x0038 */ unsigned short TlsIndex; /* +0x003a */ unsigned char HashLinks[8]; /* +0x003c 80 10 00 00 */ unsigned long TimeDateStamp; /* +0x0044 */ unsigned char EntryPointActivationContext[4]; /* +0x0048 60 10 00 00 */ void *PatchInformation; /* +0x004c */ unsigned char DdagNode[4]; /* +0x0050 f3 1d 00 00 */ unsigned char NodeModuleLink[8]; /* +0x0054 80 10 00 00 */ unsigned char SnapContext[4]; /* +0x005c f5 1d 00 00 */ void *SwitchBackContext; /* +0x0060 */ unsigned char BaseAddressIndexNode[12]; /* +0x0064 03 11 00 00 */ unsigned char MappingInfoIndexNode[12]; /* +0x0070 03 11 00 00 */ unsigned long OriginalBase; /* +0x007c */ unsigned char LoadTime[8]; /* +0x0080 34 10 00 00 */ unsigned long BaseNameHashValue; /* +0x0088 */ }; struct _WUDFMESSAGE_REMOTE_INTERFACE_ARRIVAL_REPLY { unsigned char Header[8]; /* +0x0000 eb 13 00 00 */ unsigned long long InterfaceContext; /* +0x0008 */ }; struct _PEB_LDR_DATA { unsigned long Length; /* +0x0000 */ unsigned char Initialized; /* +0x0004 */ void *SsHandle; /* +0x0008 */ unsigned char InLoadOrderModuleList[8]; /* +0x000c 80 10 00 00 */ unsigned char InMemoryOrderModuleList[8]; /* +0x0014 80 10 00 00 */ unsigned char InInitializationOrderModuleList[8]; /* +0x001c 80 10 00 00 */ void *EntryInProgress; /* +0x0024 */ unsigned char ShutdownInProgress; /* +0x0028 */ void *ShutdownThreadId; /* +0x002c */ }; struct _ULARGE_INTEGER:: { unsigned long LowPart; /* +0x0000 */ unsigned long HighPart; /* +0x0004 */ }; enum ReplacesCorHdrNumericDefines { COMIMAGE_FLAGS_ILONLY = 1, COMIMAGE_FLAGS_32BITREQUIRED = 2, COMIMAGE_FLAGS_IL_LIBRARY = 4, COMIMAGE_FLAGS_STRONGNAMESIGNED = 8, COMIMAGE_FLAGS_NATIVE_ENTRYPOINT = 16, /* COMIMAGE_FLAGS_TRACKDEBUGDATA = Unavail */ }; struct $_TypeDescriptor$_extraBytes_26 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[26]; /* +0x0008 02 1e 00 00 */ }; struct _RTL_BALANCED_NODE:: { /* unsigned char Children[0]; +0x0000 05 11 00 00 */ unsigned char Left[4]; /* +0x0000 04 11 00 00 */ unsigned char Right[4]; /* +0x0004 04 11 00 00 */ }; struct _RTL_BALANCED_NODE:::: { unsigned char Left[4]; /* +0x0000 04 11 00 00 */ unsigned char Right[4]; /* +0x0004 04 11 00 00 */ }; struct _RTL_BALANCED_NODE:: { /* unsigned char Red[0]; +0x0000 06 11 00 00 */ /* unsigned char Balance[0]; +0x0000 35 10 00 00 */ unsigned long ParentValue; /* +0x0000 */ }; struct $_TypeDescriptor$_extraBytes_30 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[30]; /* +0x0008 0d 1e 00 00 */ }; enum tagURLZONE { URLZONE_INVALID = -1, URLZONE_PREDEFINED_MIN = 0, URLZONE_LOCAL_MACHINE = 0, URLZONE_INTRANET = 1, URLZONE_TRUSTED = 2, URLZONE_INTERNET = 3, URLZONE_UNTRUSTED = 4, URLZONE_PREDEFINED_MAX = 999, URLZONE_USER_MIN = 1000, URLZONE_USER_MAX = 10000 }; struct WDF_DUMP_CONTEXT { void *ProcessHandle; /* +0x0000 */ void *DumpFileHandle; /* +0x0004 */ unsigned char ExceptionPointers[4]; /* +0x0008 9e 18 00 00 */ unsigned long DriverStopThreadId; /* +0x000c */ unsigned char Hr[4]; /* +0x0010 08 00 00 00 */ }; struct tagSAFEARRAYBOUND { unsigned long cElements; /* +0x0000 */ long lLbound; /* +0x0004 */ }; struct $_TypeDescriptor$_extraBytes_18 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[18]; /* +0x0008 18 1e 00 00 */ }; struct tagIDLDESC { unsigned long dwReserved; /* +0x0000 */ unsigned short wIDLFlags; /* +0x0004 */ }; struct _tagSTACKFRAME64 { unsigned char AddrPC[16]; /* +0x0000 b2 13 00 00 */ unsigned char AddrReturn[16]; /* +0x0010 b2 13 00 00 */ unsigned char AddrFrame[16]; /* +0x0020 b2 13 00 00 */ unsigned char AddrStack[16]; /* +0x0030 b2 13 00 00 */ unsigned char AddrBStore[16]; /* +0x0040 b2 13 00 00 */ void *FuncTableEntry; /* +0x0050 */ unsigned char Params[32]; /* +0x0058 1d 1e 00 00 */ unsigned char Far[4]; /* +0x0078 74 00 00 00 */ unsigned char Virtual[4]; /* +0x007c 74 00 00 00 */ unsigned char Reserved[24]; /* +0x0080 43 10 00 00 */ unsigned char KdHelp[112]; /* +0x0098 bd 13 00 00 */ }; struct $_TypeDescriptor$_extraBytes_28 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[28]; /* +0x0008 21 1e 00 00 */ }; struct _ACTIVATION_CONTEXT_STACK { unsigned char ActiveFrame[4]; /* +0x0000 25 1e 00 00 */ unsigned char FrameListCache[8]; /* +0x0004 80 10 00 00 */ unsigned long Flags; /* +0x000c */ unsigned long NextCookieSequenceNumber; /* +0x0010 */ unsigned long StackId; /* +0x0014 */ }; struct _RTL_DRIVE_LETTER_CURDIR { unsigned short Flags; /* +0x0000 */ unsigned short Length; /* +0x0002 */ unsigned long TimeStamp; /* +0x0004 */ unsigned char DosPath[8]; /* +0x0008 e7 10 00 00 */ }; struct $_TypeDescriptor$_extraBytes_15 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[15]; /* +0x0008 2b 1e 00 00 */ }; struct tagTYPEDESC { /* unsigned char lptdesc[0]; +0x0000 2e 1e 00 00 */ /* unsigned char lpadesc[0]; +0x0000 30 1e 00 00 */ unsigned long hreftype; /* +0x0000 */ unsigned short vt; /* +0x0004 */ }; struct tagTYPEDESC:: { /* unsigned char lptdesc[0]; +0x0000 2e 1e 00 00 */ /* unsigned char lpadesc[0]; +0x0000 30 1e 00 00 */ unsigned long hreftype; /* +0x0000 */ }; struct _WNODE_HEADER { unsigned long BufferSize; /* +0x0000 */ unsigned long ProviderId; /* +0x0004 */ unsigned long long HistoricalContext; /* +0x0008 */ unsigned long Version; /* +0x0008 */ unsigned long Linkage; /* +0x000c */ unsigned long CountLost; /* +0x0010 */ void *KernelHandle; /* +0x0010 */ unsigned char TimeStamp[8]; /* +0x0010 34 10 00 00 */ unsigned char Guid[16]; /* +0x0018 13 10 00 00 */ unsigned long ClientContext; /* +0x0028 */ unsigned long Flags; /* +0x002c */ }; struct _WNODE_HEADER:: { unsigned long long HistoricalContext; /* +0x0000 */ unsigned long Version; /* +0x0000 */ unsigned long Linkage; /* +0x0004 */ }; struct _WNODE_HEADER:::: { unsigned long Version; /* +0x0000 */ unsigned long Linkage; /* +0x0004 */ }; struct _WNODE_HEADER:: { unsigned long CountLost; /* +0x0000 */ void *KernelHandle; /* +0x0000 */ unsigned char TimeStamp[8]; /* +0x0000 34 10 00 00 */ }; struct __MIDL___MIDL_itf_wdfplatform_0000_0000_0003 { unsigned char bTrackObjects[4]; /* +0x0000 74 00 00 00 */ unsigned char bTrackRefCounts[4]; /* +0x0004 74 00 00 00 */ unsigned long nMaxRefCountChangesToTrack; /* +0x0008 */ unsigned long nMaxStackDepthToTrack; /* +0x000c */ }; enum tagTYSPEC { TYSPEC_CLSID = 0, TYSPEC_FILEEXT = 1, TYSPEC_MIMETYPE = 2, TYSPEC_FILENAME = 3, TYSPEC_PROGID = 4, TYSPEC_PACKAGENAME = 5, TYSPEC_OBJECTID = 6 }; struct _FLOATING_SAVE_AREA { unsigned long ControlWord; /* +0x0000 */ unsigned long StatusWord; /* +0x0004 */ unsigned long TagWord; /* +0x0008 */ unsigned long ErrorOffset; /* +0x000c */ unsigned long ErrorSelector; /* +0x0010 */ unsigned long DataOffset; /* +0x0014 */ unsigned long DataSelector; /* +0x0018 */ unsigned char RegisterArea[80]; /* +0x001c 42 1e 00 00 */ unsigned long Cr0NpxState; /* +0x006c */ }; struct $_s__RTTIBaseClassArray$_extraBytes_24 { unsigned char arrayOfBaseClassDescriptors[25]; /* +0x0000 46 1e 00 00 */ }; struct { /* unsigned char typeInfo_WdfLpc[0]; +0x0000 af 15 00 00 */ /* unsigned char typeInfo_WdfLpcCommPort[0]; +0x0000 63 15 00 00 */ /* unsigned char typeInfo_CPlatformEvent[0]; +0x0000 35 19 00 00 */ unsigned char typeInfo_STACKFRAME64[4]; /* +0x0000 fb 19 00 00 */ }; struct $_TypeDescriptor$_extraBytes_16 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[16]; /* +0x0008 4d 1e 00 00 */ }; enum tagCOINITBASE { COINITBASE_MULTITHREADED = 0 }; enum tagDESCKIND { DESCKIND_NONE = 0, DESCKIND_FUNCDESC = 1, DESCKIND_VARDESC = 2, DESCKIND_TYPECOMP = 3, DESCKIND_IMPLICITAPPOBJ = 4, DESCKIND_MAX = 5 }; struct tagCY { unsigned long Lo; /* +0x0000 */ long Hi; /* +0x0004 */ long long int64; /* +0x0000 */ }; struct tagCY:: { unsigned long Lo; /* +0x0000 */ long Hi; /* +0x0004 */ }; enum _LDR_DDAG_STATE { LdrModulesMerged = -1, LdrModulesInitError = -1, LdrModulesSnapError = -1, LdrModulesUnloaded = -1, LdrModulesUnloading = -1, LdrModulesPlaceHolder = 0, LdrModulesMapping = 1, LdrModulesMapped = 2, LdrModulesWaitingForDependencies = 3, LdrModulesSnapping = 4, LdrModulesSnapped = 5, LdrModulesCondensed = 6, LdrModulesReadyToInit = 7, LdrModulesInitializing = 8, LdrModulesReadyToRun = 9 }; struct _LDR_DDAG_NODE { unsigned char Modules[8]; /* +0x0000 80 10 00 00 */ unsigned char ServiceTagList[4]; /* +0x0008 77 1e 00 00 */ unsigned long LoadCount; /* +0x000c */ unsigned long ReferenceCount; /* +0x0010 */ unsigned long DependencyCount; /* +0x0014 */ /* unsigned char Dependencies[0]; +0x0018 78 1e 00 00 */ unsigned char RemovalLink[4]; /* +0x0018 c8 10 00 00 */ unsigned char IncomingDependencies[4]; /* +0x001c 78 1e 00 00 */ unsigned char State[4]; /* +0x0020 7a 1e 00 00 */ unsigned char CondenseLink[4]; /* +0x0024 c8 10 00 00 */ unsigned long PreorderNumber; /* +0x0028 */ unsigned long LowestLink; /* +0x002c */ }; struct _LDR_DDAG_NODE:: { /* unsigned char Dependencies[0]; +0x0000 78 1e 00 00 */ unsigned char RemovalLink[4]; /* +0x0000 c8 10 00 00 */ }; enum _PS_WAKE_REASON { PsWakeReasonUser = 0, PsWakeReasonDevice = 1, PsWakeReasonKernel = 2, PsWakeReasonPower = 3, PsMaxWakeReasons = 4 }; enum _tagQUERYOPTION { QUERY_EXPIRATION_DATE = 1, QUERY_TIME_OF_LAST_CHANGE = 2, QUERY_CONTENT_ENCODING = 3, QUERY_CONTENT_TYPE = 4, QUERY_REFRESH = 5, QUERY_RECOMBINE = 6, QUERY_CAN_NAVIGATE = 7, QUERY_USES_NETWORK = 8, QUERY_IS_CACHED = 9, QUERY_IS_INSTALLEDENTRY = 10, QUERY_IS_CACHED_OR_MAPPED = 11, QUERY_USES_CACHE = 12, QUERY_IS_SECURE = 13, QUERY_IS_SAFE = 14, QUERY_USES_HISTORYFOLDER = 15, QUERY_IS_CACHED_AND_USABLE_OFFLINE = 16 }; struct _LDR_DATA_TABLE_ENTRY:: { /* unsigned char InInitializationOrderLinks[0]; +0x0000 80 10 00 00 */ unsigned char InProgressLinks[8]; /* +0x0000 80 10 00 00 */ }; struct _LDR_DATA_TABLE_ENTRY:: { /* unsigned char FlagGroup[0]; +0x0000 de 1d 00 00 */ unsigned long Flags; /* +0x0000 */ /* unsigned char PackagedBinary[0]; +0x0000 3b 10 00 00 */ /* unsigned char MarkedForRemoval[0]; +0x0000 3c 10 00 00 */ /* unsigned char ImageDll[0]; +0x0000 3d 10 00 00 */ /* unsigned char LoadNotificationsSent[0]; +0x0000 3e 10 00 00 */ /* unsigned char TelemetryEntryProcessed[0]; +0x0000 3f 10 00 00 */ /* unsigned char ProcessStaticImport[0]; +0x0000 40 10 00 00 */ /* unsigned char InLegacyLists[0]; +0x0000 41 10 00 00 */ /* unsigned char InIndexes[0]; +0x0000 df 1d 00 00 */ /* unsigned char ShimDll[0]; +0x0000 e0 1d 00 00 */ /* unsigned char InExceptionTable[0]; +0x0000 e1 1d 00 00 */ /* unsigned char ReservedFlags1[0]; +0x0000 e2 1d 00 00 */ /* unsigned char LoadInProgress[0]; +0x0000 e3 1d 00 00 */ /* unsigned char ReservedFlags2[0]; +0x0000 e4 1d 00 00 */ /* unsigned char EntryProcessed[0]; +0x0000 e5 1d 00 00 */ /* unsigned char ReservedFlags3[0]; +0x0000 e6 1d 00 00 */ /* unsigned char DontCallForThreads[0]; +0x0000 e7 1d 00 00 */ /* unsigned char ProcessAttachCalled[0]; +0x0000 e8 1d 00 00 */ /* unsigned char ProcessAttachFailed[0]; +0x0000 e9 1d 00 00 */ /* unsigned char CorDeferredValidate[0]; +0x0000 ea 1d 00 00 */ /* unsigned char CorImage[0]; +0x0000 eb 1d 00 00 */ /* unsigned char DontRelocate[0]; +0x0000 ec 1d 00 00 */ /* unsigned char CorILOnly[0]; +0x0000 ed 1d 00 00 */ /* unsigned char ReservedFlags5[0]; +0x0000 ee 1d 00 00 */ /* unsigned char Redirected[0]; +0x0000 ef 1d 00 00 */ /* unsigned char ReservedFlags6[0]; +0x0000 f0 1d 00 00 */ unsigned char CompatDatabaseProcessed[4]; /* +0x0000 f1 1d 00 00 */ }; struct _LDR_DATA_TABLE_ENTRY:::: { /* unsigned char PackagedBinary[0]; +0x0000 3b 10 00 00 */ /* unsigned char MarkedForRemoval[0]; +0x0000 3c 10 00 00 */ /* unsigned char ImageDll[0]; +0x0000 3d 10 00 00 */ /* unsigned char LoadNotificationsSent[0]; +0x0000 3e 10 00 00 */ /* unsigned char TelemetryEntryProcessed[0]; +0x0000 3f 10 00 00 */ /* unsigned char ProcessStaticImport[0]; +0x0000 40 10 00 00 */ /* unsigned char InLegacyLists[0]; +0x0000 41 10 00 00 */ /* unsigned char InIndexes[0]; +0x0000 df 1d 00 00 */ /* unsigned char ShimDll[0]; +0x0000 e0 1d 00 00 */ /* unsigned char InExceptionTable[0]; +0x0000 e1 1d 00 00 */ /* unsigned char ReservedFlags1[0]; +0x0000 e2 1d 00 00 */ /* unsigned char LoadInProgress[0]; +0x0000 e3 1d 00 00 */ /* unsigned char ReservedFlags2[0]; +0x0000 e4 1d 00 00 */ /* unsigned char EntryProcessed[0]; +0x0000 e5 1d 00 00 */ /* unsigned char ReservedFlags3[0]; +0x0000 e6 1d 00 00 */ /* unsigned char DontCallForThreads[0]; +0x0000 e7 1d 00 00 */ /* unsigned char ProcessAttachCalled[0]; +0x0000 e8 1d 00 00 */ /* unsigned char ProcessAttachFailed[0]; +0x0000 e9 1d 00 00 */ /* unsigned char CorDeferredValidate[0]; +0x0000 ea 1d 00 00 */ /* unsigned char CorImage[0]; +0x0000 eb 1d 00 00 */ /* unsigned char DontRelocate[0]; +0x0000 ec 1d 00 00 */ /* unsigned char CorILOnly[0]; +0x0000 ed 1d 00 00 */ /* unsigned char ReservedFlags5[0]; +0x0000 ee 1d 00 00 */ /* unsigned char Redirected[0]; +0x0000 ef 1d 00 00 */ /* unsigned char ReservedFlags6[0]; +0x0000 f0 1d 00 00 */ unsigned char CompatDatabaseProcessed[4]; /* +0x0000 f1 1d 00 00 */ }; enum __MIDL_IUri_0001 { Uri_PROPERTY_ABSOLUTE_URI = 0, Uri_PROPERTY_STRING_START = 0, Uri_PROPERTY_AUTHORITY = 1, Uri_PROPERTY_DISPLAY_URI = 2, Uri_PROPERTY_DOMAIN = 3, Uri_PROPERTY_EXTENSION = 4, Uri_PROPERTY_FRAGMENT = 5, Uri_PROPERTY_HOST = 6, Uri_PROPERTY_PASSWORD = 7, Uri_PROPERTY_PATH = 8, Uri_PROPERTY_PATH_AND_QUERY = 9, Uri_PROPERTY_QUERY = 10, Uri_PROPERTY_RAW_URI = 11, Uri_PROPERTY_SCHEME_NAME = 12, Uri_PROPERTY_USER_INFO = 13, Uri_PROPERTY_USER_NAME = 14, Uri_PROPERTY_STRING_LAST = 14, Uri_PROPERTY_HOST_TYPE = 15, Uri_PROPERTY_DWORD_START = 15, Uri_PROPERTY_PORT = 16, Uri_PROPERTY_SCHEME = 17, Uri_PROPERTY_ZONE = 18, Uri_PROPERTY_DWORD_LAST = 18 }; enum tagBINDSTRING { BINDSTRING_HEADERS = 1, BINDSTRING_ACCEPT_MIMES = 2, BINDSTRING_EXTRA_URL = 3, BINDSTRING_LANGUAGE = 4, BINDSTRING_USERNAME = 5, BINDSTRING_PASSWORD = 6, BINDSTRING_UA_PIXELS = 7, BINDSTRING_UA_COLOR = 8, BINDSTRING_OS = 9, BINDSTRING_USER_AGENT = 10, BINDSTRING_ACCEPT_ENCODINGS = 11, BINDSTRING_POST_COOKIE = 12, BINDSTRING_POST_DATA_MIME = 13, BINDSTRING_URL = 14, BINDSTRING_IID = 15, BINDSTRING_FLAG_BIND_TO_OBJECT = 16, BINDSTRING_PTR_BIND_CONTEXT = 17, BINDSTRING_XDR_ORIGIN = 18, BINDSTRING_DOWNLOADPATH = 19, BINDSTRING_ROOTDOC_URL = 20, BINDSTRING_INITIAL_FILENAME = 21 }; struct _WUDFMESSAGE_ATTRIBUTES { /* unsigned char MessageAttributeBuffer[0]; +0x0000 8d 1e 00 00 */ unsigned char MessageAttributes[56]; /* +0x0000 2a 14 00 00 */ }; enum tagVARKIND { VAR_PERINSTANCE = 0, VAR_STATIC = 1, VAR_CONST = 2, VAR_DISPATCH = 3 }; struct tagVARDESC { long memid; /* +0x0000 */ unsigned char lpstrSchema[4]; /* +0x0004 71 04 00 00 */ unsigned long oInst; /* +0x0008 */ unsigned char lpvarValue[4]; /* +0x0008 ab 13 00 00 */ unsigned char elemdescVar[16]; /* +0x000c 90 1e 00 00 */ unsigned short wVarFlags; /* +0x001c */ unsigned char varkind[4]; /* +0x0020 92 1e 00 00 */ }; struct tagVARDESC:: { unsigned long oInst; /* +0x0000 */ unsigned char lpvarValue[4]; /* +0x0000 ab 13 00 00 */ }; struct tagARRAYDESC { unsigned char tdescElem[8]; /* +0x0000 6f 1d 00 00 */ unsigned short cDims; /* +0x0008 */ unsigned char rgbounds[8]; /* +0x000c b0 1c 00 00 */ }; struct tagEXCEPINFO { unsigned short wCode; /* +0x0000 */ unsigned short wReserved; /* +0x0002 */ unsigned char bstrSource[4]; /* +0x0004 71 04 00 00 */ unsigned char bstrDescription[4]; /* +0x0008 71 04 00 00 */ unsigned char bstrHelpFile[4]; /* +0x000c 71 04 00 00 */ unsigned long dwHelpContext; /* +0x0010 */ void *pvReserved; /* +0x0014 */ unsigned char pfnDeferredFillIn[4]; /* +0x0018 a9 1e 00 00 */ long scode; /* +0x001c */ }; enum _SE_SIGNING_LEVEL { SE_SIGNING_LEVEL_UNCHECKED = 0, SE_SIGNING_LEVEL_PROTECTED_PROCESS = 1, SE_SIGNING_LEVEL_UNSIGNED = 2, SE_SIGNING_LEVEL_AUTHENTICODE = 4, SE_SIGNING_LEVEL_DRM_PROTECTED = 5, SE_SIGNING_LEVEL_WINDOWS = 6, SE_SIGNING_LEVEL_WINDOWS_PROTECTED = 7 }; enum tagXMLEMEM_TYPE { XMLELEMTYPE_ELEMENT = 0, XMLELEMTYPE_TEXT = 1, XMLELEMTYPE_COMMENT = 2, XMLELEMTYPE_DOCUMENT = 3, XMLELEMTYPE_DTD = 4, XMLELEMTYPE_PI = 5, XMLELEMTYPE_OTHER = 6 }; struct _WUDFMESSAGE_ALL { /* unsigned char WudfMsg_CREATE_DEVICE_STACK_Message[0]; +0x0000 b0 1e 00 00 */ /* unsigned char WudfMsg_ADD_DEVICE_Message[0]; +0x0000 d9 13 00 00 */ /* unsigned char WudfMsg_IRP_Message[0]; +0x0000 b1 1e 00 00 */ /* unsigned char WudfMsg_IRP_Completion_Message[0]; +0x0000 b2 1e 00 00 */ /* unsigned char WudfMsg_CREATE_Message[0]; +0x0000 e3 13 00 00 */ /* unsigned char WudfMsg_CLOSE_Message[0]; +0x0000 b3 1e 00 00 */ /* unsigned char WudfMsg_CLEANUP_Message[0]; +0x0000 b4 1e 00 00 */ /* unsigned char WudfMsg_IO_Message[0]; +0x0000 b5 1e 00 00 */ /* unsigned char WudfMsg_Cancel_Message[0]; +0x0000 b6 1e 00 00 */ /* unsigned char WudfMsg_POWER_IRP_COMPLETE_Message[0]; +0x0000 b7 1e 00 00 */ /* unsigned char WudfMsg_CLOSE_DEVICE_STACK_Message[0]; +0x0000 b8 1e 00 00 */ /* unsigned char WudfMsg_REMOTE_INTERFACE_ARRIVAL_Message[0]; +0x0000 ff 13 00 00 */ /* unsigned char WudfMsg_REMOTE_INTERFACE_REMOVAL_Message[0]; +0x0000 b9 1e 00 00 */ /* unsigned char WudfMsg_TARGET_DEVICE_NOTIFICATION_Message[0]; +0x0000 06 14 00 00 */ /* unsigned char WudfMsg_TRANSPORT_QUERY_ID_Message[0]; +0x0000 0b 14 00 00 */ /* unsigned char WudfMsg_USB_SS_EVENT_Message[0]; +0x0000 ba 1e 00 00 */ /* unsigned char WudfMsg_ExitProcess_Message[0]; +0x0000 bb 1e 00 00 */ /* unsigned char WdfProcMgmt_Message_ControlObjectName_Message[0]; +0x0000 bc 1e 00 00 */ /* unsigned char WdfProcMgmt_Message_QueryProcess_Message[0]; +0x0000 bd 1e 00 00 */ /* unsigned char WdfProcMgmt_Message_OpenProcess_Message[0]; +0x0000 be 1e 00 00 */ /* unsigned char WdfProcMgmt_Message_CloseProcess_Message[0]; +0x0000 bf 1e 00 00 */ /* unsigned char WudfMsg_Connect_Message[0]; +0x0000 c0 1e 00 00 */ unsigned char WudfMsg_WMI_POWER_DATA_Message[88]; /* +0x0000 c1 1e 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { void *Argument1; /* +0x0000 */ void *Argument2; /* +0x0004 */ void *Argument3; /* +0x0008 */ void *Argument4; /* +0x000c */ }; enum POWER_ACTION { PowerActionNone = 0, PowerActionReserved = 1, PowerActionSleep = 2, PowerActionHibernate = 3, PowerActionShutdown = 4, PowerActionShutdownReset = 5, PowerActionShutdownOff = 6, PowerActionWarmEject = 7 }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned long SystemContext; /* +0x0000 */ unsigned char Type[4]; /* +0x0004 14 12 00 00 */ unsigned char State[4]; /* +0x0008 12 12 00 00 */ unsigned char ShutdownType[4]; /* +0x000c c8 1e 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned char PowerState[4]; /* +0x0000 f4 1c 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned char PowerSequence[12]; /* +0x0000 cd 1e 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned char Capabilities[64]; /* +0x0000 d0 1e 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned char RawSizeInBytes[4]; /* +0x0000 75 00 00 00 */ unsigned char AllocatedResources[4]; /* +0x0004 d4 1e 00 00 */ unsigned char TranslatedSizeInBytes[4]; /* +0x0008 75 00 00 00 */ unsigned char AllocatedResourcesTranslated[4]; /* +0x000c d4 1e 00 00 */ }; struct _WUDFMESSAGE_CREATE_DEVICE_STACK { unsigned char Header[1]; /* +0x0000 db 13 00 00 */ }; struct _WUDFMESSAGE_IRP { unsigned char Header[4]; /* +0x0000 db 13 00 00 */ void *Irp; /* +0x0004 */ /* unsigned char DevnodeContext[0]; +0x0008 de 13 00 00 */ unsigned char CreateContext[4]; /* +0x0008 e7 13 00 00 */ unsigned char IoStatus[8]; /* +0x000c d9 1e 00 00 */ unsigned char MajorCode; /* +0x0014 */ unsigned char MinorCode; /* +0x0015 */ unsigned char Parameters[64]; /* +0x0018 b4 1c 00 00 */ }; struct _WUDFMESSAGE_CREATE:: { /* unsigned char Header[0]; +0x0000 db 13 00 00 */ unsigned char IoHeader[24]; /* +0x0000 e5 13 00 00 */ }; struct _WDFPROCMGMT_MESSAGE_QUERY_PROCESS { unsigned char Header[4]; /* +0x0000 db 13 00 00 */ unsigned long PdoNameOffset; /* +0x0004 */ }; struct tagFUNCDESC { long memid; /* +0x0000 */ long *lprgscode; /* +0x0004 */ unsigned char lprgelemdescParam[4]; /* +0x0008 e1 1e 00 00 */ unsigned char funckind[4]; /* +0x000c d5 1d 00 00 */ unsigned char invkind[4]; /* +0x0010 38 1c 00 00 */ unsigned char callconv[4]; /* +0x0014 f2 1a 00 00 */ short cParams; /* +0x0018 */ short cParamsOpt; /* +0x001a */ short oVft; /* +0x001c */ short cScodes; /* +0x001e */ unsigned char elemdescFunc[16]; /* +0x0020 90 1e 00 00 */ unsigned short wFuncFlags; /* +0x0030 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_44 { unsigned char arrayOfBaseClassDescriptors[45]; /* +0x0000 e5 1e 00 00 */ }; struct $_TypeDescriptor$_extraBytes_25 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[25]; /* +0x0008 e9 1e 00 00 */ }; enum PIDMSI_STATUS_VALUE { PIDMSI_STATUS_NORMAL = 0, PIDMSI_STATUS_NEW = 1, PIDMSI_STATUS_PRELIM = 2, PIDMSI_STATUS_DRAFT = 3, PIDMSI_STATUS_INPROGRESS = 4, PIDMSI_STATUS_EDIT = 5, PIDMSI_STATUS_REVIEW = 6, PIDMSI_STATUS_PROOF = 7, PIDMSI_STATUS_FINAL = 8, PIDMSI_STATUS_OTHER = 32767 }; enum tagApplicationType { ServerApplication = 0, LibraryApplication = 1 }; struct _WUDFMESSAGE_WMI_POWER_DATA { unsigned char Header[4]; /* +0x0000 db 13 00 00 */ unsigned char DevnodeContext[4]; /* +0x0004 de 13 00 00 */ unsigned char WmiPowerAction[4]; /* +0x0008 f1 1e 00 00 */ }; enum WUDF_USB_SS_EVENT { UsbSSCallbackInvoked = 0, UsbSSComplete = 1 }; struct _WUDFMESSAGE_USB_SS_EVENT { unsigned char Header[4]; /* +0x0000 db 13 00 00 */ unsigned char UsbSSEvent[4]; /* +0x0004 f5 1e 00 00 */ unsigned char DevnodeContext[4]; /* +0x0008 de 13 00 00 */ }; struct _LDR_SERVICE_TAG_RECORD { unsigned char Next[4]; /* +0x0000 77 1e 00 00 */ unsigned long ServiceTag; /* +0x0004 */ }; struct _WUDFMESSAGE_POWER_IRP_COMPLETE { unsigned char Header[1]; /* +0x0000 db 13 00 00 */ unsigned char MinorFunction; /* +0x0001 */ unsigned char PowerState[4]; /* +0x0004 12 12 00 00 */ unsigned char IoStatus[8]; /* +0x0008 d9 1e 00 00 */ unsigned char DevnodeContext[4]; /* +0x0010 de 13 00 00 */ }; struct _WUDFMESSAGE_CLOSE { /* unsigned char Header[0]; +0x0000 db 13 00 00 */ unsigned char IoHeader[24]; /* +0x0000 e5 13 00 00 */ unsigned char CreateContext[8]; /* +0x0018 e7 13 00 00 */ }; struct _WUDFMESSAGE_CLOSE_DEVICE_STACK { unsigned char Header[4]; /* +0x0000 db 13 00 00 */ unsigned char DevnodeContext[4]; /* +0x0004 de 13 00 00 */ }; struct tagELEMDESC { unsigned char tdesc[8]; /* +0x0000 6f 1d 00 00 */ /* unsigned char idldesc[0]; +0x0008 70 1d 00 00 */ unsigned char paramdesc[8]; /* +0x0008 01 1f 00 00 */ }; struct tagELEMDESC:: { /* unsigned char idldesc[0]; +0x0000 70 1d 00 00 */ unsigned char paramdesc[8]; /* +0x0000 01 1f 00 00 */ }; struct _CM_RESOURCE_LIST { unsigned long Count; /* +0x0000 */ unsigned char List[32]; /* +0x0004 07 1f 00 00 */ }; enum _INTERFACE_TYPE { InterfaceTypeUndefined = -1, Internal = 0, Isa = 1, Eisa = 2, MicroChannel = 3, TurboChannel = 4, PCIBus = 5, VMEBus = 6, NuBus = 7, PCMCIABus = 8, CBus = 9, MPIBus = 10, MPSABus = 11, ProcessorInternal = 12, InternalPowerBus = 13, PNPISABus = 14, PNPBus = 15, Vmcs = 16, ACPIBus = 17, MaximumInterfaceType = 18 }; struct _CM_FULL_RESOURCE_DESCRIPTOR { unsigned char InterfaceType[4]; /* +0x0000 0b 1f 00 00 */ unsigned long BusNumber; /* +0x0004 */ unsigned char PartialResourceList[24]; /* +0x0008 0c 1f 00 00 */ }; struct _POWER_SEQUENCE { unsigned long SequenceD1; /* +0x0000 */ unsigned long SequenceD2; /* +0x0004 */ unsigned long SequenceD3; /* +0x0008 */ }; struct _IMAGE_DATA_DIRECTORY { unsigned long VirtualAddress; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct _CURDIR { unsigned char DosPath[8]; /* +0x0000 a0 10 00 00 */ void *Handle; /* +0x0008 */ }; enum _WUDF_IO_MESSAGE_CONTEXT_TYPE { WudfIoMessageContextFile = 0, WudfIoMessageContextDeviceStack = 1 }; struct _WUDFMESSAGE_IO { /* unsigned char Header[0]; +0x0000 db 13 00 00 */ unsigned char IoHeader[56]; /* +0x0000 e5 13 00 00 */ }; struct _IO_STATUS_BLOCK { long Status; /* +0x0000 */ void *Pointer; /* +0x0000 */ unsigned long Information; /* +0x0004 */ }; struct _WUDFMESSAGE_IRP_COMPLETION { unsigned char Header[4]; /* +0x0000 db 13 00 00 */ unsigned char CompletionContext[4]; /* +0x0004 b8 1c 00 00 */ unsigned char IoStatus[8]; /* +0x0008 d9 1e 00 00 */ unsigned char Parameters[64]; /* +0x0010 b4 1c 00 00 */ }; struct _WDFPROCMGMT_MESSAGE_CONTROL_OBJECT_NAME { unsigned char Header[4]; /* +0x0000 db 13 00 00 */ unsigned long ControlObjectNameOffset; /* +0x0004 */ }; struct _IO_STATUS_BLOCK:: { long Status; /* +0x0000 */ void *Pointer; /* +0x0000 */ }; struct _LDRP_CSLIST { unsigned char Tail[4]; /* +0x0000 c9 10 00 00 */ }; struct _DEVICE_CAPABILITIES { unsigned short Size; /* +0x0000 */ unsigned short Version; /* +0x0002 */ /* unsigned char DeviceD1[0]; +0x0004 3b 10 00 00 */ /* unsigned char DeviceD2[0]; +0x0004 3c 10 00 00 */ /* unsigned char LockSupported[0]; +0x0004 3d 10 00 00 */ /* unsigned char EjectSupported[0]; +0x0004 3e 10 00 00 */ /* unsigned char Removable[0]; +0x0004 3f 10 00 00 */ /* unsigned char DockDevice[0]; +0x0004 40 10 00 00 */ /* unsigned char UniqueID[0]; +0x0004 41 10 00 00 */ /* unsigned char SilentInstall[0]; +0x0004 df 1d 00 00 */ /* unsigned char RawDeviceOK[0]; +0x0004 e0 1d 00 00 */ /* unsigned char SurpriseRemovalOK[0]; +0x0004 e1 1d 00 00 */ /* unsigned char WakeFromD0[0]; +0x0004 27 1f 00 00 */ /* unsigned char WakeFromD1[0]; +0x0004 28 1f 00 00 */ /* unsigned char WakeFromD2[0]; +0x0004 e3 1d 00 00 */ /* unsigned char WakeFromD3[0]; +0x0004 e4 1d 00 00 */ /* unsigned char HardwareDisabled[0]; +0x0004 e5 1d 00 00 */ /* unsigned char NonDynamic[0]; +0x0004 29 1f 00 00 */ /* unsigned char WarmEjectSupported[0]; +0x0004 2a 1f 00 00 */ /* unsigned char NoDisplayInUI[0]; +0x0004 2b 1f 00 00 */ /* unsigned char Reserved1[0]; +0x0004 e7 1d 00 00 */ unsigned char Reserved[4]; /* +0x0004 2c 1f 00 00 */ unsigned long Address; /* +0x0008 */ unsigned long UINumber; /* +0x000c */ unsigned char DeviceState[28]; /* +0x0010 2d 1f 00 00 */ unsigned char SystemWake[4]; /* +0x002c f4 1c 00 00 */ unsigned char DeviceWake[4]; /* +0x0030 f7 11 00 00 */ unsigned long D1Latency; /* +0x0034 */ unsigned long D2Latency; /* +0x0038 */ unsigned long D3Latency; /* +0x003c */ }; struct _CM_PARTIAL_RESOURCE_LIST { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned long Count; /* +0x0004 */ unsigned char PartialDescriptors[16]; /* +0x0008 31 1f 00 00 */ }; struct tagPARAMDESC { unsigned char pparamdescex[4]; /* +0x0000 37 1f 00 00 */ unsigned short wParamFlags; /* +0x0004 */ }; struct tagBINDPTR { /* unsigned char lpfuncdesc[0]; +0x0000 22 1c 00 00 */ /* unsigned char lpvardesc[0]; +0x0000 27 1c 00 00 */ unsigned char lptcomp[4]; /* +0x0000 1d 1c 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR { unsigned char Type; /* +0x0000 */ unsigned char ShareDisposition; /* +0x0001 */ unsigned short Flags; /* +0x0002 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 34 10 00 00 */ unsigned long Length; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Level; /* +0x0000 */ unsigned long Vector; /* +0x0004 */ unsigned long Affinity; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { /* unsigned char Raw[0]; +0x0000 54 1f 00 00 */ unsigned char Translated[12]; /* +0x0000 55 1f 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::::::: { unsigned short Reserved; /* +0x0000 */ unsigned short MessageCount; /* +0x0002 */ unsigned long Vector; /* +0x0004 */ unsigned long Affinity; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Channel; /* +0x0000 */ unsigned long Port; /* +0x0004 */ unsigned long Reserved1; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Channel; /* +0x0000 */ unsigned long RequestLine; /* +0x0004 */ unsigned long Reserved1; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Data[12]; /* +0x0000 45 10 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Start; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Reserved; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long DataSize; /* +0x0000 */ unsigned long Reserved1; /* +0x0004 */ unsigned long Reserved2; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 34 10 00 00 */ unsigned long Length40; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 34 10 00 00 */ unsigned long Length48; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 34 10 00 00 */ unsigned long Length64; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Class; /* +0x0000 */ unsigned char Type; /* +0x0001 */ unsigned char Reserved1; /* +0x0002 */ unsigned char Reserved2; /* +0x0003 */ unsigned long IdLowPart; /* +0x0004 */ unsigned long IdHighPart; /* +0x0008 */ }; struct _WUDFMESSAGE_CANCEL { /* unsigned char Header[0]; +0x0000 db 13 00 00 */ unsigned char IoHeader[24]; /* +0x0000 e5 13 00 00 */ unsigned long long RequestIdToCancel; /* +0x0018 */ }; struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME { unsigned char Previous[4]; /* +0x0000 25 1e 00 00 */ unsigned char ActivationContext[4]; /* +0x0004 60 10 00 00 */ unsigned long Flags; /* +0x0008 */ }; struct _WUDFMESSAGE_REMOTE_INTERFACE_REMOVAL { unsigned char Header[4]; /* +0x0000 db 13 00 00 */ unsigned char DevnodeContext[4]; /* +0x0004 de 13 00 00 */ unsigned char DeviceContext[8]; /* +0x0008 02 14 00 00 */ unsigned long long InterfaceContext; /* +0x0010 */ }; struct tagPARAMDESCEX { unsigned long cBytes; /* +0x0000 */ unsigned char varDefaultValue[16]; /* +0x0008 aa 13 00 00 */ }; struct _WDFPROCMGMT_MESSAGE_CLOSE_PROCESS { unsigned char Header[1]; /* +0x0000 db 13 00 00 */ unsigned char HasProblem[3]; /* +0x0001 30 00 00 00 */ unsigned char HostProblem[28]; /* +0x0004 56 13 00 00 */ void *ProcessHandle; /* +0x0020 */ }; struct _WUDFMESSAGE_IO:: { /* unsigned char CreateContext[0]; +0x0000 e7 13 00 00 */ unsigned char DevnodeContext[4]; /* +0x0000 de 13 00 00 */ }; struct _WUDFMESSAGE_IO:::: { unsigned long IoControlCode; /* +0x0000 */ }; struct _WUDFMESSAGE_IO:::: { unsigned long Key; /* +0x0000 */ unsigned char ByteOffset[8]; /* +0x0008 34 10 00 00 */ }; enum _FILE_INFORMATION_CLASS { FileDirectoryInformation = 1, FileFullDirectoryInformation = 2, FileBothDirectoryInformation = 3, FileBasicInformation = 4, FileStandardInformation = 5, FileInternalInformation = 6, FileEaInformation = 7, FileAccessInformation = 8, FileNameInformation = 9, FileRenameInformation = 10, FileLinkInformation = 11, FileNamesInformation = 12, FileDispositionInformation = 13, FilePositionInformation = 14, FileFullEaInformation = 15, FileModeInformation = 16, FileAlignmentInformation = 17, FileAllInformation = 18, FileAllocationInformation = 19, FileEndOfFileInformation = 20, FileAlternateNameInformation = 21, FileStreamInformation = 22, FilePipeInformation = 23, FilePipeLocalInformation = 24, FilePipeRemoteInformation = 25, FileMailslotQueryInformation = 26, FileMailslotSetInformation = 27, FileCompressionInformation = 28, FileObjectIdInformation = 29, FileCompletionInformation = 30, FileMoveClusterInformation = 31, FileQuotaInformation = 32, FileReparsePointInformation = 33, FileNetworkOpenInformation = 34, FileAttributeTagInformation = 35, FileTrackingInformation = 36, FileIdBothDirectoryInformation = 37, FileIdFullDirectoryInformation = 38, FileValidDataLengthInformation = 39, FileShortNameInformation = 40, FileIoCompletionNotificationInformation = 41, FileIoStatusBlockRangeInformation = 42, FileIoPriorityHintInformation = 43, FileSfioReserveInformation = 44, FileSfioVolumeInformation = 45, FileHardLinkInformation = 46, FileProcessIdsUsingFileInformation = 47, FileNormalizedNameInformation = 48, FileNetworkPhysicalNameInformation = 49, FileIdGlobalTxDirectoryInformation = 50, FileIsRemoteDeviceInformation = 51, FileAttributeCacheInformation = 52, FileNumaNodeInformation = 53, FileStandardLinkInformation = 54, FileRemoteProtocolInformation = 55, FileRenameInformationBypassAccessCheck = 56, FileLinkInformationBypassAccessCheck = 57, FileIntegrityStreamInformation = 58, FileVolumeNameInformation = 59, FileMaximumInformation = 60 }; struct _WUDFMESSAGE_IO:::: { unsigned char FileInformationClass[4]; /* +0x0000 87 1f 00 00 */ }; struct _WUDFMESSAGE_IRP:: { /* unsigned char DevnodeContext[0]; +0x0000 de 13 00 00 */ unsigned char CreateContext[4]; /* +0x0000 e7 13 00 00 */ };