/* Header autogenerated by Brandon Falk's PDB Dumper * * Invocation: C:\projects\pdbdump_2\pdbdump.exe L:\symbolarchive\win8_spB_x86\wudfrd.pdb\B215DDCAF6B5402790659880D2A60FDF1\wudfrd.pdb */ struct LIST_ENTRY64 { unsigned long long Flink; /* +0x0000 */ unsigned long long Blink; /* +0x0008 */ }; struct LIST_ENTRY32 { unsigned long Flink; /* +0x0000 */ unsigned long Blink; /* +0x0004 */ }; struct _GUID { unsigned long Data1; /* +0x0000 */ unsigned short Data2; /* +0x0004 */ unsigned short Data3; /* +0x0006 */ unsigned char Data4[8]; /* +0x0008 16 10 00 00 */ }; struct _KSYSTEM_TIME { unsigned long LowPart; /* +0x0000 */ long High1Time; /* +0x0004 */ long High2Time; /* +0x0008 */ }; enum _NT_PRODUCT_TYPE { NtProductWinNt = 1, NtProductLanManNt = 2, NtProductServer = 3 }; enum _ALTERNATIVE_ARCHITECTURE_TYPE { StandardDesign = 0, NEC98x86 = 1, EndAlternatives = 2 }; struct _KUSER_SHARED_DATA { unsigned long TickCountLowDeprecated; /* +0x0000 */ unsigned long TickCountMultiplier; /* +0x0004 */ unsigned char InterruptTime[12]; /* +0x0008 23 10 00 00 */ unsigned char SystemTime[12]; /* +0x0014 23 10 00 00 */ unsigned char TimeZoneBias[12]; /* +0x0020 23 10 00 00 */ unsigned short ImageNumberLow; /* +0x002c */ unsigned short ImageNumberHigh; /* +0x002e */ unsigned char NtSystemRoot[520]; /* +0x0030 2b 10 00 00 */ unsigned long MaxStackTraceDepth; /* +0x0238 */ unsigned long CryptoExponent; /* +0x023c */ unsigned long TimeZoneId; /* +0x0240 */ unsigned long LargePageMinimum; /* +0x0244 */ unsigned long AitSamplingValue; /* +0x0248 */ unsigned long AppCompatFlag; /* +0x024c */ unsigned long long RNGSeedVersion; /* +0x0250 */ unsigned long GlobalValidationRunlevel; /* +0x0258 */ unsigned char Reserved2[8]; /* +0x025c 2c 10 00 00 */ unsigned char NtProductType[4]; /* +0x0264 2e 10 00 00 */ unsigned char ProductTypeIsValid; /* +0x0268 */ unsigned char Reserved0[1]; /* +0x0269 2f 10 00 00 */ unsigned short NativeProcessorArchitecture; /* +0x026a */ unsigned long NtMajorVersion; /* +0x026c */ unsigned long NtMinorVersion; /* +0x0270 */ unsigned char ProcessorFeatures[64]; /* +0x0274 30 10 00 00 */ unsigned long Reserved1; /* +0x02b4 */ unsigned long Reserved3; /* +0x02b8 */ unsigned char TimeSlip[4]; /* +0x02bc 27 10 00 00 */ unsigned char AlternativeArchitecture[4]; /* +0x02c0 32 10 00 00 */ unsigned char AltArchitecturePad[4]; /* +0x02c4 33 10 00 00 */ unsigned char SystemExpirationDate[8]; /* +0x02c8 34 10 00 00 */ unsigned long SuiteMask; /* +0x02d0 */ unsigned char KdDebuggerEnabled; /* +0x02d4 */ unsigned char MitigationPolicies; /* +0x02d5 */ /* unsigned char NXSupportPolicy[0]; +0x02d5 35 10 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x02d5 36 10 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x02d5 37 10 00 00 */ unsigned char Reserved[1]; /* +0x02d5 38 10 00 00 */ unsigned char Reserved6[2]; /* +0x02d6 39 10 00 00 */ unsigned char ActiveConsoleId[4]; /* +0x02d8 27 10 00 00 */ unsigned char DismountCount[4]; /* +0x02dc 27 10 00 00 */ unsigned long ComPlusPackage; /* +0x02e0 */ unsigned long LastSystemRITEventTickCount; /* +0x02e4 */ unsigned long NumberOfPhysicalPages; /* +0x02e8 */ unsigned char SafeBootMode; /* +0x02ec */ unsigned char Reserved12[3]; /* +0x02ed 3a 10 00 00 */ unsigned long SharedDataFlags; /* +0x02f0 */ /* unsigned char DbgErrorPortPresent[0]; +0x02f0 3b 10 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x02f0 3c 10 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x02f0 3d 10 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x02f0 3e 10 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x02f0 3f 10 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x02f0 40 10 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x02f0 41 10 00 00 */ unsigned char SpareBits[4]; /* +0x02f0 42 10 00 00 */ unsigned char DataFlagsPad[4]; /* +0x02f4 33 10 00 00 */ unsigned long long TestRetInstruction; /* +0x02f8 */ unsigned long Reserved9; /* +0x0300 */ unsigned long Reserved10; /* +0x0304 */ unsigned char SystemCallPad[24]; /* +0x0308 43 10 00 00 */ /* unsigned char TickCount[0]; +0x0320 23 10 00 00 */ /* unsigned char TickCountQuad[0]; +0x0320 44 10 00 00 */ unsigned char ReservedTickCountOverlay[12]; /* +0x0320 45 10 00 00 */ unsigned char TickCountPad[4]; /* +0x032c 33 10 00 00 */ unsigned long Cookie; /* +0x0330 */ unsigned char CookiePad[4]; /* +0x0334 33 10 00 00 */ long long ConsoleSessionForegroundProcessId; /* +0x0338 */ unsigned char TimeUpdateSequence[8]; /* +0x0340 44 10 00 00 */ unsigned long long LastTimeUpdateQpcValue; /* +0x0348 */ unsigned long long LastInterruptTimeUpdateQpcValue; /* +0x0350 */ unsigned long long QpcTimeIncrement; /* +0x0358 */ unsigned long QpcTimeIncrement32; /* +0x0360 */ unsigned char Reserved8[28]; /* +0x0364 46 10 00 00 */ unsigned char UserModeGlobalLogger[32]; /* +0x0380 47 10 00 00 */ unsigned long ImageFileExecutionOptions; /* +0x03a0 */ unsigned long LangGenerationCount; /* +0x03a4 */ unsigned char InterruptTimeBias[8]; /* +0x03a8 44 10 00 00 */ unsigned char TscQpcBias[8]; /* +0x03b0 44 10 00 00 */ unsigned char ActiveProcessorCount[4]; /* +0x03b8 27 10 00 00 */ unsigned char ActiveGroupCount[1]; /* +0x03bc 48 10 00 00 */ unsigned char QpcTimeIncrementShift; /* +0x03bd */ unsigned short TscQpcData; /* +0x03be */ unsigned char TscQpcEnabled[1]; /* +0x03be 48 10 00 00 */ unsigned char TscQpcShift; /* +0x03bf */ unsigned char XState[528]; /* +0x03c0 49 10 00 00 */ }; struct _ULARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ unsigned long HighPart; /* +0x0004 */ }; struct _LARGE_INTEGER { unsigned long LowPart; /* +0x0000 */ long HighPart; /* +0x0004 */ }; enum _TP_CALLBACK_PRIORITY { TP_CALLBACK_PRIORITY_HIGH = 0, TP_CALLBACK_PRIORITY_NORMAL = 1, TP_CALLBACK_PRIORITY_LOW = 2, TP_CALLBACK_PRIORITY_INVALID = 3, TP_CALLBACK_PRIORITY_COUNT = 3 }; struct _TP_CALLBACK_ENVIRON_V3 { unsigned long Version; /* +0x0000 */ unsigned char Pool[4]; /* +0x0004 59 10 00 00 */ unsigned char CleanupGroup[4]; /* +0x0008 5b 10 00 00 */ unsigned char CleanupGroupCancelCallback[4]; /* +0x000c 5e 10 00 00 */ void *RaceDll; /* +0x0010 */ unsigned char ActivationContext[4]; /* +0x0014 60 10 00 00 */ unsigned char FinalizationCallback[16]; /* +0x0018 65 10 00 00 */ }; struct _TP_CALLBACK_ENVIRON_V3:: { unsigned long Flags; /* +0x0000 */ }; struct _TP_CALLBACK_ENVIRON_V3:::: { /* unsigned char LongFunction[0]; +0x0000 3b 10 00 00 */ /* unsigned char Persistent[0]; +0x0000 3c 10 00 00 */ unsigned char Private[4]; /* +0x0000 78 10 00 00 */ }; struct _TP_TASK { unsigned char Callbacks[4]; /* +0x0000 7f 10 00 00 */ unsigned long NumaNode; /* +0x0004 */ unsigned char IdealProcessor; /* +0x0008 */ unsigned char ListEntry[8]; /* +0x000c 80 10 00 00 */ }; struct _TP_TASK_CALLBACKS { unsigned char ExecuteCallback[4]; /* +0x0000 86 10 00 00 */ unsigned char Unposted[4]; /* +0x0004 89 10 00 00 */ }; struct _TEB { unsigned char NtTib[28]; /* +0x0000 92 10 00 00 */ void *EnvironmentPointer; /* +0x001c */ unsigned char ClientId[8]; /* +0x0020 93 10 00 00 */ void *ActiveRpcHandle; /* +0x0028 */ void *ThreadLocalStoragePointer; /* +0x002c */ unsigned char ProcessEnvironmentBlock[4]; /* +0x0030 95 10 00 00 */ unsigned long LastErrorValue; /* +0x0034 */ unsigned long CountOfOwnedCriticalSections; /* +0x0038 */ void *CsrClientThread; /* +0x003c */ void *Win32ThreadInfo; /* +0x0040 */ unsigned char User32Reserved[104]; /* +0x0044 96 10 00 00 */ unsigned char UserReserved[20]; /* +0x00ac 97 10 00 00 */ void *WOW32Reserved; /* +0x00c0 */ unsigned long CurrentLocale; /* +0x00c4 */ unsigned long FpSoftwareStatusRegister; /* +0x00c8 */ unsigned char SystemReserved1[216]; /* +0x00cc 98 10 00 00 */ long ExceptionCode; /* +0x01a4 */ unsigned char ActivationContextStackPointer[4]; /* +0x01a8 9a 10 00 00 */ unsigned char SpareBytes[36]; /* +0x01ac 9b 10 00 00 */ unsigned long TxFsContext; /* +0x01d0 */ unsigned char GdiTebBatch[1248]; /* +0x01d4 9c 10 00 00 */ unsigned char RealClientId[8]; /* +0x06b4 93 10 00 00 */ void *GdiCachedProcessHandle; /* +0x06bc */ unsigned long GdiClientPID; /* +0x06c0 */ unsigned long GdiClientTID; /* +0x06c4 */ void *GdiThreadLocalInfo; /* +0x06c8 */ unsigned char Win32ClientInfo[248]; /* +0x06cc 9d 10 00 00 */ unsigned char glDispatchTable[932]; /* +0x07c4 9e 10 00 00 */ unsigned char glReserved1[116]; /* +0x0b68 9f 10 00 00 */ void *glReserved2; /* +0x0bdc */ void *glSectionInfo; /* +0x0be0 */ void *glSection; /* +0x0be4 */ void *glTable; /* +0x0be8 */ void *glCurrentRC; /* +0x0bec */ void *glContext; /* +0x0bf0 */ unsigned long LastStatusValue; /* +0x0bf4 */ unsigned char StaticUnicodeString[8]; /* +0x0bf8 a0 10 00 00 */ unsigned char StaticUnicodeBuffer[524]; /* +0x0c00 a1 10 00 00 */ void *DeallocationStack; /* +0x0e0c */ unsigned char TlsSlots[256]; /* +0x0e10 a2 10 00 00 */ unsigned char TlsLinks[8]; /* +0x0f10 80 10 00 00 */ void *Vdm; /* +0x0f18 */ void *ReservedForNtRpc; /* +0x0f1c */ unsigned char DbgSsReserved[8]; /* +0x0f20 a3 10 00 00 */ unsigned long HardErrorMode; /* +0x0f28 */ unsigned char Instrumentation[36]; /* +0x0f2c a4 10 00 00 */ unsigned char ActivityId[16]; /* +0x0f50 13 10 00 00 */ void *SubProcessTag; /* +0x0f60 */ void *EtwLocalData; /* +0x0f64 */ void *EtwTraceData; /* +0x0f68 */ void *WinSockData; /* +0x0f6c */ unsigned long GdiBatchCount; /* +0x0f70 */ /* unsigned char CurrentIdealProcessor[0]; +0x0f74 a5 10 00 00 */ unsigned long IdealProcessorValue; /* +0x0f74 */ unsigned char ReservedPad0; /* +0x0f74 */ unsigned char ReservedPad1; /* +0x0f75 */ unsigned char ReservedPad2; /* +0x0f76 */ unsigned char IdealProcessor; /* +0x0f77 */ unsigned long GuaranteedStackBytes; /* +0x0f78 */ void *ReservedForPerf; /* +0x0f7c */ void *ReservedForOle; /* +0x0f80 */ unsigned long WaitingOnLoaderLock; /* +0x0f84 */ void *SavedPriorityState; /* +0x0f88 */ unsigned long ReservedForCodeCoverage; /* +0x0f8c */ void *ThreadPoolData; /* +0x0f90 */ unsigned char TlsExpansionSlots[4]; /* +0x0f94 21 10 00 00 */ unsigned long MuiGeneration; /* +0x0f98 */ unsigned long IsImpersonating; /* +0x0f9c */ void *NlsCache; /* +0x0fa0 */ void *pShimData; /* +0x0fa4 */ unsigned short HeapVirtualAffinity; /* +0x0fa8 */ unsigned short LowFragHeapDataSlot; /* +0x0faa */ void *CurrentTransactionHandle; /* +0x0fac */ unsigned char ActiveFrame[4]; /* +0x0fb0 a7 10 00 00 */ void *FlsData; /* +0x0fb4 */ void *PreferredLanguages; /* +0x0fb8 */ void *UserPrefLanguages; /* +0x0fbc */ void *MergedPrefLanguages; /* +0x0fc0 */ unsigned long MuiImpersonation; /* +0x0fc4 */ /* unsigned char CrossTebFlags[0]; +0x0fc8 a8 10 00 00 */ unsigned char SpareCrossTebBits[2]; /* +0x0fc8 a9 10 00 00 */ unsigned short SameTebFlags; /* +0x0fca */ /* unsigned char SafeThunkCall[0]; +0x0fca aa 10 00 00 */ /* unsigned char InDebugPrint[0]; +0x0fca ab 10 00 00 */ /* unsigned char HasFiberData[0]; +0x0fca ac 10 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x0fca ad 10 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x0fca ae 10 00 00 */ /* unsigned char RanProcessInit[0]; +0x0fca af 10 00 00 */ /* unsigned char ClonedThread[0]; +0x0fca b0 10 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x0fca b1 10 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x0fca b2 10 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x0fca b3 10 00 00 */ /* unsigned char InitialThread[0]; +0x0fca b4 10 00 00 */ /* unsigned char SessionAware[0]; +0x0fca b5 10 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x0fca b6 10 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x0fca b7 10 00 00 */ void *TxnScopeEnterCallback; /* +0x0fcc */ void *TxnScopeExitCallback; /* +0x0fd0 */ void *TxnScopeContext; /* +0x0fd4 */ unsigned long LockCount; /* +0x0fd8 */ unsigned long SpareUlong0; /* +0x0fdc */ void *ResourceRetValue; /* +0x0fe0 */ void *ReservedForWdf; /* +0x0fe4 */ }; struct _LIST_ENTRY { unsigned char Flink[4]; /* +0x0000 ba 10 00 00 */ unsigned char Blink[4]; /* +0x0004 ba 10 00 00 */ }; struct _SINGLE_LIST_ENTRY { unsigned char Next[4]; /* +0x0000 c9 10 00 00 */ }; struct _RTL_SPLAY_LINKS { unsigned char Parent[4]; /* +0x0000 ce 10 00 00 */ unsigned char LeftChild[4]; /* +0x0004 ce 10 00 00 */ unsigned char RightChild[4]; /* +0x0008 ce 10 00 00 */ }; struct _RTL_DYNAMIC_HASH_TABLE_CONTEXT { unsigned char ChainHead[4]; /* +0x0000 ba 10 00 00 */ unsigned char PrevLinkage[4]; /* +0x0004 ba 10 00 00 */ unsigned long Signature; /* +0x0008 */ }; struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR { unsigned char HashEntry[12]; /* +0x0000 d8 10 00 00 */ unsigned char ChainHead[4]; /* +0x000c ba 10 00 00 */ unsigned long BucketIndex; /* +0x0010 */ }; struct _RTL_DYNAMIC_HASH_TABLE_ENTRY { unsigned char Linkage[8]; /* +0x0000 80 10 00 00 */ unsigned long Signature; /* +0x0008 */ }; struct _RTL_DYNAMIC_HASH_TABLE { unsigned long Flags; /* +0x0000 */ unsigned long Shift; /* +0x0004 */ unsigned long TableSize; /* +0x0008 */ unsigned long Pivot; /* +0x000c */ unsigned long DivisorMask; /* +0x0010 */ unsigned long NumEntries; /* +0x0014 */ unsigned long NonEmptyBuckets; /* +0x0018 */ unsigned long NumEnumerators; /* +0x001c */ void *Directory; /* +0x0020 */ }; struct _UNICODE_STRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ unsigned char Buffer[4]; /* +0x0004 71 04 00 00 */ }; struct _STRING { unsigned short Length; /* +0x0000 */ unsigned short MaximumLength; /* +0x0002 */ char *Buffer; /* +0x0004 */ }; struct _LARGE_INTEGER:: { unsigned long LowPart; /* +0x0000 */ long HighPart; /* +0x0004 */ }; struct _IMAGE_NT_HEADERS { unsigned long Signature; /* +0x0000 */ unsigned char FileHeader[20]; /* +0x0004 f6 10 00 00 */ unsigned char OptionalHeader[224]; /* +0x0018 f7 10 00 00 */ }; struct _IMAGE_DOS_HEADER { unsigned short e_magic; /* +0x0000 */ unsigned short e_cblp; /* +0x0002 */ unsigned short e_cp; /* +0x0004 */ unsigned short e_crlc; /* +0x0006 */ unsigned short e_cparhdr; /* +0x0008 */ unsigned short e_minalloc; /* +0x000a */ unsigned short e_maxalloc; /* +0x000c */ unsigned short e_ss; /* +0x000e */ unsigned short e_sp; /* +0x0010 */ unsigned short e_csum; /* +0x0012 */ unsigned short e_ip; /* +0x0014 */ unsigned short e_cs; /* +0x0016 */ unsigned short e_lfarlc; /* +0x0018 */ unsigned short e_ovno; /* +0x001a */ unsigned char e_res[8]; /* +0x001c fc 10 00 00 */ unsigned short e_oemid; /* +0x0024 */ unsigned short e_oeminfo; /* +0x0026 */ unsigned char e_res2[20]; /* +0x0028 fd 10 00 00 */ long e_lfanew; /* +0x003c */ }; struct _RTL_BALANCED_NODE { /* unsigned char Children[0]; +0x0000 05 11 00 00 */ unsigned char Left[4]; /* +0x0000 04 11 00 00 */ unsigned char Right[4]; /* +0x0004 04 11 00 00 */ /* unsigned char Red[0]; +0x0008 06 11 00 00 */ /* unsigned char Balance[0]; +0x0008 35 10 00 00 */ unsigned long ParentValue; /* +0x0008 */ }; struct _RTL_RB_TREE { unsigned char Root[4]; /* +0x0000 04 11 00 00 */ unsigned char Min[4]; /* +0x0004 04 11 00 00 */ }; struct _RTL_AVL_TREE { unsigned char Root[4]; /* +0x0000 04 11 00 00 */ }; struct _KPRCB { unsigned short MinorVersion; /* +0x0000 */ unsigned short MajorVersion; /* +0x0002 */ unsigned char CurrentThread[4]; /* +0x0004 30 11 00 00 */ unsigned char NextThread[4]; /* +0x0008 30 11 00 00 */ unsigned char IdleThread[4]; /* +0x000c 30 11 00 00 */ unsigned char LegacyNumber; /* +0x0010 */ unsigned char NestingLevel; /* +0x0011 */ unsigned short BuildType; /* +0x0012 */ char CpuType; /* +0x0014 */ char CpuID; /* +0x0015 */ unsigned short CpuStep; /* +0x0016 */ unsigned char CpuStepping; /* +0x0016 */ unsigned char CpuModel; /* +0x0017 */ unsigned char ProcessorState[800]; /* +0x0018 31 11 00 00 */ unsigned char KernelReserved[64]; /* +0x0338 32 11 00 00 */ unsigned char HalReserved[64]; /* +0x0378 32 11 00 00 */ unsigned long CFlushSize; /* +0x03b8 */ unsigned char CoresPerPhysicalProcessor; /* +0x03bc */ unsigned char LogicalProcessorsPerCore; /* +0x03bd */ unsigned char PrcbPad0[2]; /* +0x03be 39 10 00 00 */ unsigned long MHz; /* +0x03c0 */ unsigned char CpuVendor; /* +0x03c4 */ unsigned char GroupIndex; /* +0x03c5 */ unsigned short Group; /* +0x03c6 */ unsigned long GroupSetMember; /* +0x03c8 */ unsigned long Number; /* +0x03cc */ unsigned char ClockOwner; /* +0x03d0 */ unsigned char PendingTick; /* +0x03d1 */ unsigned char PrcbPad1[70]; /* +0x03d2 33 11 00 00 */ unsigned char LockQueue[136]; /* +0x0418 35 11 00 00 */ }; struct _EVENT_DATA_DESCRIPTOR { unsigned long long Ptr; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ }; struct _EVENT_DESCRIPTOR { unsigned short Id; /* +0x0000 */ unsigned char Version; /* +0x0002 */ unsigned char Channel; /* +0x0003 */ unsigned char Level; /* +0x0004 */ unsigned char Opcode; /* +0x0005 */ unsigned short Task; /* +0x0006 */ unsigned long long Keyword; /* +0x0008 */ }; struct _FAST_MUTEX { unsigned char Count[4]; /* +0x0000 1f 10 00 00 */ void *Owner; /* +0x0004 */ unsigned long Contention; /* +0x0008 */ unsigned char Event[16]; /* +0x000c 4b 11 00 00 */ unsigned long OldIrql; /* +0x001c */ }; enum _EVENT_TYPE { NotificationEvent = 0, SynchronizationEvent = 1 }; struct _KEVENT { unsigned char Header[16]; /* +0x0000 54 11 00 00 */ }; struct _SLIST_HEADER { unsigned long long Alignment; /* +0x0000 */ unsigned char Next[4]; /* +0x0000 c8 10 00 00 */ unsigned short Depth; /* +0x0004 */ unsigned short Sequence; /* +0x0006 */ }; struct _LOOKASIDE_LIST_EX { unsigned char L[72]; /* +0x0000 5d 11 00 00 */ }; enum _POOL_TYPE { NonPagedPool = 0, NonPagedPoolExecute = 0, PagedPool = 1, NonPagedPoolMustSucceed = 2, DontUseThisType = 3, NonPagedPoolCacheAligned = 4, PagedPoolCacheAligned = 5, NonPagedPoolCacheAlignedMustS = 6, MaxPoolType = 7, NonPagedPoolBase = 0, NonPagedPoolBaseMustSucceed = 2, NonPagedPoolBaseCacheAligned = 4, NonPagedPoolBaseCacheAlignedMustS = 6, NonPagedPoolSession = 32, PagedPoolSession = 33, NonPagedPoolMustSucceedSession = 34, DontUseThisTypeSession = 35, NonPagedPoolCacheAlignedSession = 36, PagedPoolCacheAlignedSession = 37, NonPagedPoolCacheAlignedMustSSession = 38, NonPagedPoolNx = 512, NonPagedPoolNxCacheAligned = 516, NonPagedPoolSessionNx = 544 }; struct _GENERAL_LOOKASIDE_POOL { /* unsigned char ListHead[0]; +0x0000 57 11 00 00 */ unsigned char SingleListHead[8]; /* +0x0000 c8 10 00 00 */ unsigned short Depth; /* +0x0008 */ unsigned short MaximumDepth; /* +0x000a */ unsigned long TotalAllocates; /* +0x000c */ unsigned long AllocateMisses; /* +0x0010 */ unsigned long AllocateHits; /* +0x0010 */ unsigned long TotalFrees; /* +0x0014 */ unsigned long FreeMisses; /* +0x0018 */ unsigned long FreeHits; /* +0x0018 */ unsigned char Type[4]; /* +0x001c 63 11 00 00 */ unsigned long Tag; /* +0x0020 */ unsigned long Size; /* +0x0024 */ /* unsigned char AllocateEx[0]; +0x0028 66 11 00 00 */ unsigned char Allocate[4]; /* +0x0028 69 11 00 00 */ /* unsigned char FreeEx[0]; +0x002c 6c 11 00 00 */ unsigned char Free[4]; /* +0x002c 6f 11 00 00 */ unsigned char ListEntry[8]; /* +0x0030 80 10 00 00 */ unsigned long LastTotalAllocates; /* +0x0038 */ unsigned long LastAllocateMisses; /* +0x003c */ unsigned long LastAllocateHits; /* +0x003c */ unsigned char Future[8]; /* +0x0040 2c 10 00 00 */ }; struct _NPAGED_LOOKASIDE_LIST { unsigned char L[72]; /* +0x0000 7c 11 00 00 */ unsigned long Lock__ObsoleteButDoNotDelete; /* +0x0048 */ }; struct _PAGED_LOOKASIDE_LIST { unsigned char L[72]; /* +0x0000 7c 11 00 00 */ unsigned char Lock__ObsoleteButDoNotDelete[32]; /* +0x0048 49 11 00 00 */ }; struct _IO_STATUS_BLOCK { long Status; /* +0x0000 */ void *Pointer; /* +0x0000 */ unsigned long Information; /* +0x0004 */ }; struct _QUAD { long long UseThisFieldToCopy; /* +0x0000 */ unsigned char DoNotUseThisField[8]; /* +0x0000 41 00 00 00 */ }; struct _WORK_QUEUE_ITEM { unsigned char List[8]; /* +0x0000 80 10 00 00 */ unsigned char WorkerRoutine[4]; /* +0x0008 6f 11 00 00 */ void *Parameter; /* +0x000c */ }; struct _EX_PUSH_LOCK { /* unsigned char Locked[0]; +0x0000 3b 10 00 00 */ /* unsigned char Waiting[0]; +0x0000 3c 10 00 00 */ /* unsigned char Waking[0]; +0x0000 3d 10 00 00 */ /* unsigned char MultipleShared[0]; +0x0000 3e 10 00 00 */ /* unsigned char Shared[0]; +0x0000 af 11 00 00 */ unsigned long Value; /* +0x0000 */ void *Ptr; /* +0x0000 */ }; struct _PROCESSOR_NUMBER { unsigned short Group; /* +0x0000 */ unsigned char Number; /* +0x0002 */ unsigned char Reserved; /* +0x0003 */ }; struct _EX_PUSH_LOCK_CACHE_AWARE { unsigned char Locks[4]; /* +0x0000 bd 11 00 00 */ }; struct _IRP { short Type; /* +0x0000 */ unsigned short Size; /* +0x0002 */ unsigned char MdlAddress[4]; /* +0x0004 c6 11 00 00 */ unsigned long Flags; /* +0x0008 */ }; struct _IRP:::: { /* unsigned char DeviceQueueEntry[0]; +0x0000 d9 11 00 00 */ unsigned char DriverContext[16]; /* +0x0000 da 11 00 00 */ unsigned char Thread[4]; /* +0x0010 dc 11 00 00 */ char *AuxiliaryBuffer; /* +0x0014 */ unsigned char ListEntry[8]; /* +0x0018 80 10 00 00 */ /* unsigned char CurrentStackLocation[0]; +0x0020 de 11 00 00 */ unsigned long PacketType; /* +0x0020 */ unsigned char OriginalFileObject[4]; /* +0x0024 e0 11 00 00 */ void *IrpExtension; /* +0x0028 */ }; struct _IO_STACK_LOCATION { unsigned char MajorFunction; /* +0x0000 */ unsigned char MinorFunction; /* +0x0001 */ unsigned char Flags; /* +0x0002 */ unsigned char Control; /* +0x0003 */ }; struct _DEVICE_OBJECT { short Type; /* +0x0000 */ unsigned short Size; /* +0x0002 */ long ReferenceCount; /* +0x0004 */ unsigned char DriverObject[4]; /* +0x0008 f4 11 00 00 */ unsigned char NextDevice[4]; /* +0x000c ca 11 00 00 */ unsigned char AttachedDevice[4]; /* +0x0010 ca 11 00 00 */ unsigned char CurrentIrp[4]; /* +0x0014 c4 11 00 00 */ unsigned char Timer[4]; /* +0x0018 f6 11 00 00 */ unsigned long Flags; /* +0x001c */ unsigned long Characteristics; /* +0x0020 */ unsigned char Vpb[4]; /* +0x0024 f8 11 00 00 */ void *DeviceExtension; /* +0x0028 */ unsigned long DeviceType; /* +0x002c */ char StackSize; /* +0x0030 */ }; struct _KDPC { unsigned char Type; /* +0x0000 */ unsigned char Importance; /* +0x0001 */ unsigned char Number[2]; /* +0x0002 a8 10 00 00 */ unsigned char DpcListEntry[8]; /* +0x0004 80 10 00 00 */ unsigned char DeferredRoutine[4]; /* +0x000c f0 11 00 00 */ void *DeferredContext; /* +0x0010 */ void *SystemArgument1; /* +0x0014 */ void *SystemArgument2; /* +0x0018 */ void *DpcData; /* +0x001c */ }; struct _IO_DRIVER_CREATE_CONTEXT { short Size; /* +0x0000 */ unsigned char ExtraCreateParameter[4]; /* +0x0004 0f 12 00 00 */ void *DeviceObjectHint; /* +0x0008 */ unsigned char TxnParameters[4]; /* +0x000c 11 12 00 00 */ }; enum _DEVICE_POWER_STATE { PowerDeviceUnspecified = 0, PowerDeviceD0 = 1, PowerDeviceD1 = 2, PowerDeviceD2 = 3, PowerDeviceD3 = 4, PowerDeviceMaximum = 5 }; enum _DEVICE_WAKE_DEPTH { DeviceWakeDepthNotWakeable = 0, DeviceWakeDepthD0 = 1, DeviceWakeDepthD1 = 2, DeviceWakeDepthD2 = 3, DeviceWakeDepthD3hot = 4, DeviceWakeDepthD3cold = 5, DeviceWakeDepthMaximum = 6 }; struct _MDL { unsigned char Next[4]; /* +0x0000 c6 11 00 00 */ short Size; /* +0x0004 */ short MdlFlags; /* +0x0006 */ unsigned char Process[4]; /* +0x0008 1c 12 00 00 */ void *MappedSystemVa; /* +0x000c */ void *StartVa; /* +0x0010 */ unsigned long ByteCount; /* +0x0014 */ unsigned long ByteOffset; /* +0x0018 */ }; enum _MEMORY_CACHING_TYPE { MmNonCached = 0, MmCached = 1, MmWriteCombined = 2, MmHardwareCoherentCached = 3, MmNonCachedUnordered = 4, MmUSWCCached = 5, MmMaximumCacheType = 6 }; struct _ACCESS_STATE { unsigned char OperationID[8]; /* +0x0000 f2 10 00 00 */ unsigned char SecurityEvaluated; /* +0x0008 */ unsigned char GenerateAudit; /* +0x0009 */ unsigned char GenerateOnClose; /* +0x000a */ unsigned char PrivilegesAllocated; /* +0x000b */ unsigned long Flags; /* +0x000c */ unsigned long RemainingDesiredAccess; /* +0x0010 */ unsigned long PreviouslyGrantedAccess; /* +0x0014 */ unsigned long OriginalDesiredAccess; /* +0x0018 */ unsigned char SubjectSecurityContext[16]; /* +0x001c 28 12 00 00 */ void *SecurityDescriptor; /* +0x002c */ void *AuxData; /* +0x0030 */ }; struct _AUX_ACCESS_DATA { unsigned char PrivilegesUsed[4]; /* +0x0000 2f 12 00 00 */ unsigned char GenericMapping[16]; /* +0x0004 30 12 00 00 */ unsigned long AccessesToAudit; /* +0x0014 */ unsigned long MaximumAuditMask; /* +0x0018 */ unsigned char TransactionId[16]; /* +0x001c 13 10 00 00 */ void *NewSecurityDescriptor; /* +0x002c */ void *ExistingSecurityDescriptor; /* +0x0030 */ void *ParentSecurityDescriptor; /* +0x0034 */ unsigned char DeRefSecurityDescriptor[4]; /* +0x0038 5e 10 00 00 */ void *SDLock; /* +0x003c */ unsigned char AccessReasons[128]; /* +0x0040 31 12 00 00 */ unsigned char GenerateStagingEvents; /* +0x00c0 */ }; struct _OBJECT_HANDLE_INFORMATION { unsigned long HandleAttributes; /* +0x0000 */ unsigned long GrantedAccess; /* +0x0004 */ }; struct _OBJECT_TYPE { unsigned char TypeList[8]; /* +0x0000 80 10 00 00 */ unsigned char Name[8]; /* +0x0008 a0 10 00 00 */ void *DefaultObject; /* +0x0010 */ unsigned char Index; /* +0x0014 */ unsigned long TotalNumberOfObjects; /* +0x0018 */ unsigned long TotalNumberOfHandles; /* +0x001c */ unsigned long HighWaterNumberOfObjects; /* +0x0020 */ unsigned long HighWaterNumberOfHandles; /* +0x0024 */ unsigned char TypeInfo[88]; /* +0x0028 3f 12 00 00 */ unsigned char TypeLock[4]; /* +0x0080 ad 11 00 00 */ unsigned long Key; /* +0x0084 */ unsigned char CallbackList[8]; /* +0x0088 80 10 00 00 */ }; enum _WHEA_ERROR_TYPE { WheaErrTypeProcessor = 0, WheaErrTypeMemory = 1, WheaErrTypePCIExpress = 2, WheaErrTypeNMI = 3, WheaErrTypePCIXBus = 4, WheaErrTypePCIXDevice = 5, WheaErrTypeGeneric = 6 }; enum _WHEA_ERROR_SEVERITY { WheaErrSevRecoverable = 0, WheaErrSevFatal = 1, WheaErrSevCorrected = 2, WheaErrSevInformational = 3 }; enum _WHEA_ERROR_SOURCE_TYPE { WheaErrSrcTypeMCE = 0, WheaErrSrcTypeCMC = 1, WheaErrSrcTypeCPE = 2, WheaErrSrcTypeNMI = 3, WheaErrSrcTypePCIe = 4, WheaErrSrcTypeGeneric = 5, WheaErrSrcTypeINIT = 6, WheaErrSrcTypeBOOT = 7, WheaErrSrcTypeSCIGeneric = 8, WheaErrSrcTypeIPFMCA = 9, WheaErrSrcTypeIPFCMC = 10, WheaErrSrcTypeIPFCPE = 11, WheaErrSrcTypeMax = 12 }; enum _WHEA_ERROR_PACKET_DATA_FORMAT { WheaDataFormatIPFSalRecord = 0, WheaDataFormatXPFMCA = 1, WheaDataFormatMemory = 2, WheaDataFormatPCIExpress = 3, WheaDataFormatNMIPort = 4, WheaDataFormatPCIXBus = 5, WheaDataFormatPCIXDevice = 6, WheaDataFormatGeneric = 7, WheaDataFormatMax = 8 }; struct _WHEA_ERROR_PACKET_V2 { unsigned long Signature; /* +0x0000 */ unsigned long Version; /* +0x0004 */ unsigned long Length; /* +0x0008 */ unsigned char Flags[4]; /* +0x000c 44 12 00 00 */ unsigned char ErrorType[4]; /* +0x0010 46 12 00 00 */ unsigned char ErrorSeverity[4]; /* +0x0014 48 12 00 00 */ unsigned long ErrorSourceId; /* +0x0018 */ unsigned char ErrorSourceType[4]; /* +0x001c 4a 12 00 00 */ unsigned char NotifyType[16]; /* +0x0020 13 10 00 00 */ unsigned long long Context; /* +0x0030 */ unsigned char DataFormat[4]; /* +0x0038 4c 12 00 00 */ unsigned long Reserved1; /* +0x003c */ unsigned long DataOffset; /* +0x0040 */ unsigned long DataLength; /* +0x0044 */ unsigned long PshedDataOffset; /* +0x0048 */ unsigned long PshedDataLength; /* +0x004c */ }; struct _WHEA_ERROR_RECORD { unsigned char Header[128]; /* +0x0000 51 12 00 00 */ unsigned char SectionDescriptor[72]; /* +0x0080 53 12 00 00 */ }; struct _WHEA_ERROR_RECORD_HEADER { unsigned long Signature; /* +0x0000 */ unsigned char Revision[2]; /* +0x0004 58 12 00 00 */ unsigned long SignatureEnd; /* +0x0006 */ unsigned short SectionCount; /* +0x000a */ unsigned char Severity[4]; /* +0x000c 48 12 00 00 */ unsigned char ValidBits[4]; /* +0x0010 59 12 00 00 */ unsigned long Length; /* +0x0014 */ unsigned char Timestamp[8]; /* +0x0018 5a 12 00 00 */ unsigned char PlatformId[16]; /* +0x0020 13 10 00 00 */ unsigned char PartitionId[16]; /* +0x0030 13 10 00 00 */ unsigned char CreatorId[16]; /* +0x0040 13 10 00 00 */ unsigned char NotifyType[16]; /* +0x0050 13 10 00 00 */ unsigned long long RecordId; /* +0x0060 */ unsigned char Flags[4]; /* +0x0068 5b 12 00 00 */ unsigned char PersistenceInfo[8]; /* +0x006c 5c 12 00 00 */ unsigned char Reserved[12]; /* +0x0074 5d 12 00 00 */ }; struct _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR { unsigned long SectionOffset; /* +0x0000 */ unsigned long SectionLength; /* +0x0004 */ unsigned char Revision[2]; /* +0x0008 58 12 00 00 */ unsigned char ValidBits[1]; /* +0x000a 62 12 00 00 */ unsigned char Reserved; /* +0x000b */ unsigned char Flags[4]; /* +0x000c 63 12 00 00 */ unsigned char SectionType[16]; /* +0x0010 13 10 00 00 */ unsigned char FRUId[16]; /* +0x0020 13 10 00 00 */ unsigned char SectionSeverity[4]; /* +0x0030 48 12 00 00 */ unsigned char FRUText[20]; /* +0x0034 64 12 00 00 */ }; struct _WHEA_REVISION { unsigned char MinorRevision; /* +0x0000 */ unsigned char MajorRevision; /* +0x0001 */ unsigned short AsUSHORT; /* +0x0000 */ }; struct _iobuf { char *_ptr; /* +0x0000 */ unsigned char _cnt[4]; /* +0x0004 74 00 00 00 */ char *_base; /* +0x0008 */ unsigned char _flag[4]; /* +0x000c 74 00 00 00 */ unsigned char _file[4]; /* +0x0010 74 00 00 00 */ unsigned char _charbuf[4]; /* +0x0014 74 00 00 00 */ unsigned char _bufsiz[4]; /* +0x0018 74 00 00 00 */ char *_tmpfname; /* +0x001c */ }; struct localeinfo_struct { unsigned char locinfo[4]; /* +0x0000 d9 12 00 00 */ unsigned char mbcinfo[4]; /* +0x0004 db 12 00 00 */ }; struct _ldiv_t { long quot; /* +0x0000 */ long rem; /* +0x0004 */ }; struct tagPROPVARIANT { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ char cVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char hVal[0]; +0x0008 34 10 00 00 */ /* unsigned char uhVal[0]; +0x0008 4c 10 00 00 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 f7 12 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char filetime[0]; +0x0008 f8 12 00 00 */ /* unsigned char puuid[0]; +0x0008 69 12 00 00 */ /* unsigned char pclipdata[0]; +0x0008 fa 12 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 04 00 00 */ /* unsigned char bstrblobVal[0]; +0x0008 fb 12 00 00 */ /* unsigned char blob[0]; +0x0008 fc 12 00 00 */ char *pszVal; /* +0x0008 */ /* unsigned char pwszVal[0]; +0x0008 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0008 fe 12 00 00 */ /* unsigned char pdispVal[0]; +0x0008 00 13 00 00 */ /* unsigned char pStream[0]; +0x0008 02 13 00 00 */ /* unsigned char pStorage[0]; +0x0008 04 13 00 00 */ /* unsigned char pVersionedStream[0]; +0x0008 06 13 00 00 */ /* unsigned char parray[0]; +0x0008 08 13 00 00 */ /* unsigned char cac[0]; +0x0008 09 13 00 00 */ /* unsigned char caub[0]; +0x0008 0a 13 00 00 */ /* unsigned char cai[0]; +0x0008 0b 13 00 00 */ /* unsigned char caui[0]; +0x0008 0c 13 00 00 */ /* unsigned char cal[0]; +0x0008 0d 13 00 00 */ /* unsigned char caul[0]; +0x0008 0e 13 00 00 */ /* unsigned char cah[0]; +0x0008 0f 13 00 00 */ /* unsigned char cauh[0]; +0x0008 10 13 00 00 */ /* unsigned char caflt[0]; +0x0008 11 13 00 00 */ /* unsigned char cadbl[0]; +0x0008 12 13 00 00 */ /* unsigned char cabool[0]; +0x0008 13 13 00 00 */ /* unsigned char cascode[0]; +0x0008 14 13 00 00 */ /* unsigned char cacy[0]; +0x0008 15 13 00 00 */ /* unsigned char cadate[0]; +0x0008 16 13 00 00 */ /* unsigned char cafiletime[0]; +0x0008 17 13 00 00 */ /* unsigned char cauuid[0]; +0x0008 18 13 00 00 */ /* unsigned char caclipdata[0]; +0x0008 19 13 00 00 */ /* unsigned char cabstr[0]; +0x0008 1a 13 00 00 */ /* unsigned char cabstrblob[0]; +0x0008 1b 13 00 00 */ /* unsigned char calpstr[0]; +0x0008 1c 13 00 00 */ /* unsigned char calpwstr[0]; +0x0008 1d 13 00 00 */ /* unsigned char capropvar[0]; +0x0008 1e 13 00 00 */ char *pcVal; /* +0x0008 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ long *plVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 04 00 00 */ /* unsigned char pfltVal[0]; +0x0008 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 04 00 00 */ short *pboolVal; /* +0x0008 */ /* unsigned char pdecVal[0]; +0x0008 20 13 00 00 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 21 13 00 00 */ /* unsigned char pdate[0]; +0x0008 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e6 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 22 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 23 13 00 00 */ /* unsigned char pparray[0]; +0x0008 24 13 00 00 */ /* unsigned char pvarVal[-8]; +0x0008 f6 12 00 00 */ unsigned char decVal[16]; /* +0x0000 1f 13 00 00 */ }; enum WudfProblem { WudfProblem_None = 0, WudfProblem_Cancelled = 1, WudfProblem_SendFailure = 2, WudfProblem_Timeout = 3, WudfProblem_InvalidRequest = 4, WudfProblem_InvalidReply = 5, WudfProblem_FailedCriticalOperation = 6, WudfProblem_FailedToExit = 7, WudfProblem_Disconnect = 8, WudfProblem_LeakingHandle = 9, WudfProblem_InvalidInterruptState = 10, WudfProblem_IsrTimedOut = 11, WudfProblem_Max = 12 }; enum WdfComponentType { WdfComponentInvalid = 0, WdfComponentPlatform = 1, WdfComponentReflector = 2, WdfComponentDriverManager = 3, WdfComponentHost = 4, WdfComponentFramework = 5, WdfComponentTest = 6, WdfComponentMax = 7 }; enum _WDF_HOST_EXIT_CODE { WdfHostExit_StillActive = 259, /* WdfHostExit_CodeUnknown = Unavail */ }; enum WudfOperationType { WudfOperation_Invalid = 0, WudfOperation_Init = 1, WudfOperation_HostShutdown = 2, WudfOperation_Pnp = 3, WudfOperation_Cleanup = 4, WudfOperation_Close = 5, WudfOperation_Cancel = 6, WudfOperation_IO = 7, WudfOperation_Interrupt = 8, WudfOperation_Other = 9, WudfOperation_Max = 10 }; enum WdfDeviceStartStateType { WudfDeviceStartState_Unknown = 0, WudfDeviceStartState_NotStarted = 1, WudfDeviceStartState_Started = 2, WudfDeviceStartState_Removed = 3 }; struct WUDF_PROBLEM { unsigned char ProblemCode[4]; /* +0x0000 2a 13 00 00 */ unsigned char Detector[4]; /* +0x0004 2c 13 00 00 */ unsigned char ExitCode[4]; /* +0x0008 2e 13 00 00 */ unsigned char Operation[4]; /* +0x000c 30 13 00 00 */ unsigned long Message; /* +0x0010 */ unsigned long Status; /* +0x0014 */ unsigned char DeviceStarted[4]; /* +0x0018 32 13 00 00 */ }; enum _KINTERRUPT_MODE { LevelSensitive = 0, Latched = 1 }; enum _WDF_INTERRUPT_POLARITY { WdfInterruptPolarityUnknown = 0, WdfInterruptActiveHigh = 1, WdfInterruptActiveLow = 2 }; struct _WDF_INTERRUPT_INFO { unsigned long Size; /* +0x0000 */ unsigned long long Reserved1; /* +0x0008 */ unsigned long TargetProcessorSet; /* +0x0010 */ unsigned long Reserved2; /* +0x0014 */ unsigned long MessageNumber; /* +0x0018 */ unsigned long Vector; /* +0x001c */ unsigned char Irql; /* +0x0020 */ unsigned char Mode[4]; /* +0x0024 4c 13 00 00 */ unsigned char Polarity[4]; /* +0x0028 4e 13 00 00 */ unsigned char MessageSignaled; /* +0x002c */ unsigned char ShareDisposition; /* +0x002d */ unsigned short Group; /* +0x0030 */ }; enum _WDF_INTERRUPT_POLICY { WdfIrqPolicyMachineDefault = 0, WdfIrqPolicyAllCloseProcessors = 1, WdfIrqPolicyOneCloseProcessor = 2, WdfIrqPolicyAllProcessorsInMachine = 3, WdfIrqPolicySpecifiedProcessors = 4, WdfIrqPolicySpreadMessagesAcrossAllProcessors = 5 }; enum _WDF_INTERRUPT_PRIORITY { WdfIrqPriorityUndefined = 0, WdfIrqPriorityLow = 1, WdfIrqPriorityNormal = 2, WdfIrqPriorityHigh = 3 }; struct _WDF_INTERRUPT_EXTENDED_POLICY { unsigned long Size; /* +0x0000 */ unsigned char Policy[4]; /* +0x0004 54 13 00 00 */ unsigned char Priority[4]; /* +0x0008 56 13 00 00 */ unsigned char TargetProcessorSetAndGroup[12]; /* +0x000c 57 13 00 00 */ }; struct _WUDFMESSAGE_ADD_DEVICE { unsigned char Header[4]; /* +0x0000 5e 13 00 00 */ unsigned long AttachDeviceNameOffset; /* +0x0004 */ unsigned char InternalReferenceStringValid[4]; /* +0x0008 39 10 00 00 */ unsigned char InternalReferenceStringOffset[8]; /* +0x000c 2c 10 00 00 */ unsigned long PdoNameOffset; /* +0x0014 */ void *DeviceObjectPointer; /* +0x0018 */ }; enum _WUDF_CONTROL_OBJ_REF_STRING { WudfRefStringMin = 0, WudfRefStringElevations = 0, WudfRefStringNullFile = 1, WudfRefStringMax = 2, WudfRefStringUnknown = 2 }; struct _WUDFMESSAGE_CREATE { /* unsigned char Header[0]; +0x0000 5e 13 00 00 */ unsigned char IoHeader[24]; /* +0x0000 68 13 00 00 */ unsigned char DevnodeContext[4]; /* +0x0018 61 13 00 00 */ unsigned long FileNameByteLength; /* +0x001c */ unsigned long Options; /* +0x0020 */ unsigned short FileAttributes; /* +0x0024 */ unsigned short ShareAccess; /* +0x0026 */ unsigned long DesiredAccess; /* +0x0028 */ unsigned char RelatedCreateContext[4]; /* +0x002c 6a 13 00 00 */ unsigned long InitiatorProcessId; /* +0x0030 */ }; struct _WUDFMESSAGE_REPLY_HEADER { long NtStatus; /* +0x0000 */ }; struct _WUDFMESSAGE_IO_REPLY { unsigned char Header[4]; /* +0x0000 6e 13 00 00 */ unsigned long Information; /* +0x0004 */ }; struct _WDFPROCMGMT_MESSAGE_QUERY_PROCESS_REPLY { unsigned char Header[4]; /* +0x0000 6e 13 00 00 */ unsigned long ProcessTimeout; /* +0x0004 */ }; struct _WDFPROCMGMT_MESSAGE_OPEN_PROCESS_REPLY { unsigned char Header[4]; /* +0x0000 6e 13 00 00 */ void *ProcessHandle; /* +0x0004 */ }; struct _WUDFMESSAGE_REMOTE_INTERFACE_ARRIVAL { unsigned char Header[4]; /* +0x0000 5e 13 00 00 */ unsigned char InterfaceGuid[16]; /* +0x0004 13 10 00 00 */ unsigned char DevnodeContext[4]; /* +0x0014 61 13 00 00 */ unsigned char DeviceContext[4]; /* +0x0018 85 13 00 00 */ }; struct _WUDFMESSAGE_TARGET_DEVICE_NOTIFICATION { unsigned char Header[4]; /* +0x0000 5e 13 00 00 */ unsigned char Event[16]; /* +0x0004 13 10 00 00 */ unsigned char DevnodeContext[4]; /* +0x0014 61 13 00 00 */ unsigned long long TargetContext; /* +0x0018 */ unsigned long CustomBufferSize; /* +0x0020 */ unsigned long NameBufferOffset; /* +0x0024 */ }; struct _WUDFMESSAGE_TRANSPORT_QUERY_ID { unsigned char Header[4]; /* +0x0000 5e 13 00 00 */ unsigned char DevnodeContext[4]; /* +0x0004 61 13 00 00 */ unsigned long Id; /* +0x0008 */ unsigned long BufferSize; /* +0x000c */ }; struct WUDF_EVENT { void *Value; /* +0x0000 */ }; struct _ALPC_MESSAGE_ATTRIBUTES { unsigned long AllocatedAttributes; /* +0x0000 */ unsigned long ValidAttributes; /* +0x0004 */ }; struct WdfCtorStatus { long m_ConstructorStatus; /* +0x0000 */ }; enum WdfDriverStopType { WdfInternalError = 0, WdfDriverError = 1, WdfCallerError = 2, WdfExternalError = 3, WdfUnhandledExceptionError = 4, WdfDriverStopTypeMax = 5 }; enum WdfErrorClass { WdfErrorClass_Undefined = 0, WdfErrorClass_BadArgument = 1, WdfErrorClass_BadState = 2, WdfErrorClass_BadResponse = 3, WdfErrorClass_BadAction = 4, WdfErrorClass_LostReference = 5, WdfErrorClass_GlobalMax = 6, WdfErrorClass_PlatformStart = 6, WdfErrorClass_PlatformMax = 7, WdfErrorClass_RdStart = 6, WdfErrorClass_RdMax = 7, WdfErrorClass_DmStart = 6, WdfErrorClass_DmMax = 7, WdfErrorClass_HostStart = 6, WdfErrorClass_HostMax = 7, WdfErrorClass_FxStart = 6, WdfErrorClass_FxMax = 7, WdfErrorClass_TestStart = 6, WdfErrorClass_TestMax = 7 }; enum WELL_KNOWN_SID_TYPE { WinNullSid = 0, WinWorldSid = 1, WinLocalSid = 2, WinCreatorOwnerSid = 3, WinCreatorGroupSid = 4, WinCreatorOwnerServerSid = 5, WinCreatorGroupServerSid = 6, WinNtAuthoritySid = 7, WinDialupSid = 8, WinNetworkSid = 9, WinBatchSid = 10, WinInteractiveSid = 11, WinServiceSid = 12, WinAnonymousSid = 13, WinProxySid = 14, WinEnterpriseControllersSid = 15, WinSelfSid = 16, WinAuthenticatedUserSid = 17, WinRestrictedCodeSid = 18, WinTerminalServerSid = 19, WinRemoteLogonIdSid = 20, WinLogonIdsSid = 21, WinLocalSystemSid = 22, WinLocalServiceSid = 23, WinNetworkServiceSid = 24, WinBuiltinDomainSid = 25, WinBuiltinAdministratorsSid = 26, WinBuiltinUsersSid = 27, WinBuiltinGuestsSid = 28, WinBuiltinPowerUsersSid = 29, WinBuiltinAccountOperatorsSid = 30, WinBuiltinSystemOperatorsSid = 31, WinBuiltinPrintOperatorsSid = 32, WinBuiltinBackupOperatorsSid = 33, WinBuiltinReplicatorSid = 34, WinBuiltinPreWindows2000CompatibleAccessSid = 35, WinBuiltinRemoteDesktopUsersSid = 36, WinBuiltinNetworkConfigurationOperatorsSid = 37, WinAccountAdministratorSid = 38, WinAccountGuestSid = 39, WinAccountKrbtgtSid = 40, WinAccountDomainAdminsSid = 41, WinAccountDomainUsersSid = 42, WinAccountDomainGuestsSid = 43, WinAccountComputersSid = 44, WinAccountControllersSid = 45, WinAccountCertAdminsSid = 46, WinAccountSchemaAdminsSid = 47, WinAccountEnterpriseAdminsSid = 48, WinAccountPolicyAdminsSid = 49, WinAccountRasAndIasServersSid = 50, WinNTLMAuthenticationSid = 51, WinDigestAuthenticationSid = 52, WinSChannelAuthenticationSid = 53, WinThisOrganizationSid = 54, WinOtherOrganizationSid = 55, WinBuiltinIncomingForestTrustBuildersSid = 56, WinBuiltinPerfMonitoringUsersSid = 57, WinBuiltinPerfLoggingUsersSid = 58, WinBuiltinAuthorizationAccessSid = 59, WinBuiltinTerminalServerLicenseServersSid = 60, WinBuiltinDCOMUsersSid = 61, WinBuiltinIUsersSid = 62, WinIUserSid = 63, WinBuiltinCryptoOperatorsSid = 64, WinUntrustedLabelSid = 65, WinLowLabelSid = 66, WinMediumLabelSid = 67, WinHighLabelSid = 68, WinSystemLabelSid = 69, WinWriteRestrictedCodeSid = 70, WinCreatorOwnerRightsSid = 71, WinCacheablePrincipalsGroupSid = 72, WinNonCacheablePrincipalsGroupSid = 73, WinEnterpriseReadonlyControllersSid = 74, WinAccountReadonlyControllersSid = 75, WinBuiltinEventLogReadersGroup = 76, WinNewEnterpriseReadonlyControllersSid = 77, WinBuiltinCertSvcDComAccessGroup = 78, WinMediumPlusLabelSid = 79, WinLocalLogonSid = 80, WinConsoleLogonSid = 81, WinThisOrganizationCertificateSid = 82, WinApplicationPackageAuthoritySid = 83, WinBuiltinAnyPackageSid = 84, WinCapabilityInternetClientSid = 85, WinCapabilityInternetClientServerSid = 86, WinCapabilityPrivateNetworkClientServerSid = 87, WinCapabilityPicturesLibrarySid = 88, WinCapabilityVideosLibrarySid = 89, WinCapabilityMusicLibrarySid = 90, WinCapabilityDocumentsLibrarySid = 91, WinCapabilitySharedUserCertificatesSid = 92, WinCapabilityDefaultWindowsCredentialsSid = 93, WinCapabilityRemovableStorageSid = 94, WinBuiltinRDSRemoteAccessServersSid = 95, WinBuiltinRDSEndpointServersSid = 96, WinBuiltinRDSManagementServersSid = 97, WinUserModeDriversSid = 98, WinBuiltinHyperVAdminsSid = 99 }; enum WdfPoolType { WdfNonPagedPool = 0, WdfPagedPool = 1, WdfPoolChargeQuota = 128 }; enum RdWmiRegisteredState { WmiUnregistered = 0, WmiRegistered = 1, WmiDeregistered = 2 }; struct RdWmi { unsigned char m_FdoDevice[4]; /* +0x0000 80 14 00 00 */ unsigned char m_RegisteredState[4]; /* +0x0004 82 14 00 00 */ unsigned char m_Mutex[32]; /* +0x0008 49 11 00 00 */ unsigned char m_RdWmiGuidList[24]; /* +0x0028 84 14 00 00 */ unsigned char m_WmiLibInfo[32]; /* +0x0040 85 14 00 00 */ }; struct _WMIGUIDREGINFO { unsigned char Guid[4]; /* +0x0000 15 10 00 00 */ unsigned long InstanceCount; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ }; enum _WMIENABLEDISABLECONTROL { WmiEventControl = 0, WmiDataBlockControl = 1 }; struct _WMILIB_CONTEXT { unsigned long GuidCount; /* +0x0000 */ unsigned char GuidList[4]; /* +0x0004 ad 14 00 00 */ unsigned char QueryWmiRegInfo[4]; /* +0x0008 b5 14 00 00 */ unsigned char QueryWmiDataBlock[4]; /* +0x000c b7 14 00 00 */ unsigned char SetWmiDataBlock[4]; /* +0x0010 b9 14 00 00 */ unsigned char SetWmiDataItem[4]; /* +0x0014 bb 14 00 00 */ unsigned char ExecuteWmiMethod[4]; /* +0x0018 be 14 00 00 */ unsigned char WmiFunctionControl[4]; /* +0x001c c3 14 00 00 */ }; struct _MCGEN_TRACE_CONTEXT { unsigned char Callback[8]; /* +0x0000 d2 14 00 00 */ unsigned long long Logger; /* +0x0008 */ unsigned long long RegistrationHandle; /* +0x0010 */ unsigned long long MatchAnyKeyword; /* +0x0018 */ unsigned long long MatchAllKeyword; /* +0x0020 */ unsigned char ControlGuid[4]; /* +0x0028 15 10 00 00 */ unsigned char PfnEtwWrite[4]; /* +0x002c d5 14 00 00 */ unsigned char PfnEtwRegister[4]; /* +0x0030 dd 14 00 00 */ unsigned char PfnEtwUnregister[4]; /* +0x0034 e0 14 00 00 */ unsigned char pfnPsGetVersion[4]; /* +0x0038 e3 14 00 00 */ unsigned long Flags; /* +0x003c */ unsigned long IsEnabled; /* +0x0040 */ unsigned char Level; /* +0x0044 */ unsigned char McGenPreVista; /* +0x0045 */ unsigned char McGenTracingSupportInit; /* +0x0046 */ unsigned short EnableBitsCount; /* +0x0048 */ unsigned long *EnableBitMask; /* +0x004c */ unsigned char EnableKeyWords[4]; /* +0x0050 48 11 00 00 */ unsigned char EnableLevel[4]; /* +0x0054 46 11 00 00 */ }; struct _EVENT_FILTER_DESCRIPTOR { unsigned long long Ptr; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned long Type; /* +0x000c */ }; struct WMIREGINFOW { unsigned long BufferSize; /* +0x0000 */ unsigned long NextWmiRegInfo; /* +0x0004 */ unsigned long RegistryPath; /* +0x0008 */ unsigned long MofResourceName; /* +0x000c */ unsigned long GuidCount; /* +0x0010 */ /* unsigned char WmiRegGuid[0]; +0x0014 00 15 00 00 */ }; struct WMIREGGUIDW { unsigned char Guid[16]; /* +0x0000 13 10 00 00 */ unsigned long Flags; /* +0x0010 */ unsigned long InstanceCount; /* +0x0014 */ unsigned long InstanceNameList; /* +0x0018 */ unsigned long BaseNameOffset; /* +0x0018 */ unsigned long Pdo; /* +0x0018 */ unsigned long InstanceInfo; /* +0x0018 */ }; struct _WNODE_HEADER { unsigned long BufferSize; /* +0x0000 */ unsigned long ProviderId; /* +0x0004 */ unsigned long long HistoricalContext; /* +0x0008 */ unsigned long Version; /* +0x0008 */ unsigned long Linkage; /* +0x000c */ unsigned long CountLost; /* +0x0010 */ void *KernelHandle; /* +0x0010 */ unsigned char TimeStamp[8]; /* +0x0010 34 10 00 00 */ unsigned char Guid[16]; /* +0x0018 13 10 00 00 */ unsigned long ClientContext; /* +0x0028 */ unsigned long Flags; /* +0x002c */ }; enum _TRACE_INFORMATION_CLASS { TraceIdClass = 0, TraceHandleClass = 1, TraceEnableFlagsClass = 2, TraceEnableLevelClass = 3, GlobalLoggerHandleClass = 4, EventLoggerHandleClass = 5, AllLoggerHandlesClass = 6, TraceHandleByNameClass = 7, LoggerEventsLostClass = 8, TraceSessionSettingsClass = 9, LoggerEventsLoggedClass = 10, DiskIoNotifyRoutinesClass = 11, AllPossibleNotifyRoutinesClass = 12, TraceInformationClassReserved1 = 12, FltIoNotifyRoutinesClass = 13, MaxTraceInformationClass = 14 }; struct _EVENT_TRACE_HEADER { unsigned short Size; /* +0x0000 */ unsigned short FieldTypeFlags; /* +0x0002 */ unsigned char HeaderType; /* +0x0002 */ unsigned char MarkerFlags; /* +0x0003 */ unsigned long Version; /* +0x0004 */ unsigned char Class[4]; /* +0x0004 18 15 00 00 */ unsigned long ThreadId; /* +0x0008 */ unsigned long ProcessId; /* +0x000c */ unsigned char TimeStamp[8]; /* +0x0010 34 10 00 00 */ /* unsigned char Guid[0]; +0x0018 13 10 00 00 */ unsigned long long GuidPtr; /* +0x0018 */ unsigned long KernelTime; /* +0x0028 */ unsigned long UserTime; /* +0x002c */ unsigned long long ProcessorTime; /* +0x0028 */ unsigned long ClientContext; /* +0x0028 */ unsigned long Flags; /* +0x002c */ }; struct _EVENT_TRACE_HEADER:::: { unsigned char Type; /* +0x0000 */ unsigned char Level; /* +0x0001 */ unsigned short Version; /* +0x0002 */ }; struct MofTemplate_jzccppppq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 15 15 00 00 */ unsigned char EventData[144]; /* +0x0030 0f 15 00 00 */ }; struct MofTemplate_z::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 15 15 00 00 */ unsigned char EventData[16]; /* +0x0030 23 15 00 00 */ }; struct MofTemplate_zq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 15 15 00 00 */ unsigned char EventData[32]; /* +0x0030 28 15 00 00 */ }; struct MofTemplate_jzz::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 15 15 00 00 */ unsigned char EventData[48]; /* +0x0030 2d 15 00 00 */ }; struct MofTemplate_jcccqqq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 15 15 00 00 */ unsigned char EventData[112]; /* +0x0030 36 15 00 00 */ }; struct MofTemplate_jzqzj::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 15 15 00 00 */ unsigned char EventData[80]; /* +0x0030 3f 15 00 00 */ }; struct MofTemplate_jzzzzz::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 15 15 00 00 */ unsigned char EventData[96]; /* +0x0030 44 15 00 00 */ }; struct MofTemplate_jzqq::__l2::_MCGEN_TRACE_BUFFER { unsigned char Header[48]; /* +0x0000 15 15 00 00 */ unsigned char EventData[64]; /* +0x0030 49 15 00 00 */ }; enum RdCancelState { RdCancelState_NotCancelled = 0, RdCancelState_CancelRetry = 0, RdCancelState_CancelPending = 1, RdCancelState_Cancelled = 2, RdCancelState_Max = 3 }; struct RdDispatchLevelCancelHandler { unsigned char m_WorkItemForCancelAtDispatch[8]; /* +0x0000 6b 15 00 00 */ unsigned char m_IOsCancelledAtDispatch[8]; /* +0x0008 57 11 00 00 */ unsigned long m_LockForCancelAtDispatch; /* +0x0010 */ }; struct RdProcessParameters { unsigned char m_EProcess[4]; /* +0x0000 1c 12 00 00 */ unsigned char m_LifetimeId[4]; /* +0x0004 10 10 00 00 */ unsigned char m_IoEventPortName[4]; /* +0x0008 10 10 00 00 */ unsigned char m_IoCancelEventPortName[4]; /* +0x000c 10 10 00 00 */ unsigned char m_SystemEventPortName[4]; /* +0x0010 10 10 00 00 */ unsigned char m_NonStateChangingEventPortName[4]; /* +0x0014 10 10 00 00 */ unsigned long m_HostProcessTimeout; /* +0x0018 */ }; enum _SECURITY_IMPERSONATION_LEVEL { SecurityAnonymous = 0, SecurityIdentification = 1, SecurityImpersonation = 2, SecurityDelegation = 3 }; enum _MODE { KernelMode = 0, UserMode = 1, MaximumMode = 2 }; struct _DRIVER_OBJECT { short Type; /* +0x0000 */ short Size; /* +0x0002 */ unsigned char DeviceObject[4]; /* +0x0004 ca 11 00 00 */ unsigned long Flags; /* +0x0008 */ void *DriverStart; /* +0x000c */ unsigned long DriverSize; /* +0x0010 */ void *DriverSection; /* +0x0014 */ unsigned char DriverExtension[4]; /* +0x0018 68 16 00 00 */ unsigned char DriverName[8]; /* +0x001c a0 10 00 00 */ unsigned char HardwareDatabase[4]; /* +0x0024 e3 10 00 00 */ unsigned char FastIoDispatch[4]; /* +0x0028 69 16 00 00 */ unsigned char DriverInit[4]; /* +0x002c 6b 16 00 00 */ unsigned char DriverStartIo[4]; /* +0x0030 cd 11 00 00 */ unsigned char DriverUnload[4]; /* +0x0034 6d 16 00 00 */ unsigned char MajorFunction[112]; /* +0x0038 70 16 00 00 */ }; enum _WUDFMESSAGE { WudfMsg_Reserved = 0, WudfMsg_IRP = 1, WudfMsg_IRP_Completion = 2, WudfMsg_CREATE_DEVICE_STACK = 3, WudfMsg_ADD_DEVICE = 4, WudfMsg_CREATE = 5, WudfMsg_CLOSE = 6, WudfMsg_CLEANUP = 7, WudfMsg_READ = 8, WudfMsg_WRITE = 9, WudfMsg_IOCONTROL = 10, WudfMsg_FLUSH = 11, WudfMsg_QUERY_INFORMATION_FILE = 12, WudfMsg_SET_INFORMATION_FILE = 13, WudfMsg_Cancel = 14, WudfMsg_POWER_IRP_COMPLETE = 15, WudfMsg_USB_SS_EVENT = 16, WudfMsg_CLOSE_DEVICE_STACK = 17, WudfMsg_REMOTE_INTERFACE_ARRIVAL = 18, WudfMsg_REMOTE_INTERFACE_REMOVAL = 19, WudfMsg_TARGET_DEVICE_NOTIFICATION = 20, WudfMsg_TRANSPORT_QUERY_ID = 21, WudfMsg_FramworkMax = 22, WudfMsg_ExitProcess = 23, WdfProcMgmt_Message_Reserved = 24, WdfProcMgmt_Message_ControlObjectName = 25, WdfProcMgmt_Message_QueryProcess = 26, WdfProcMgmt_Message_OpenProcess = 27, WdfProcMgmt_Message_CloseProcess = 28, WudfMsg_Connect = 29, WudfMsg_WMI_POWER_DATA = 30, WudfMsg_Max = 31 }; struct _IO_STACK_LOCATION:::: { void *Argument1; /* +0x0000 */ void *Argument2; /* +0x0004 */ void *Argument3; /* +0x0008 */ void *Argument4; /* +0x000c */ }; struct RdIrpListEntry { unsigned char m_Link[8]; /* +0x0000 80 10 00 00 */ unsigned long m_RefCount; /* +0x0008 */ unsigned char m_Irp[4]; /* +0x000c c4 11 00 00 */ }; struct _KLOCK_QUEUE_HANDLE { unsigned char LockQueue[8]; /* +0x0000 34 11 00 00 */ unsigned char OldIrql; /* +0x0008 */ }; struct _FILE_OBJECT { short Type; /* +0x0000 */ short Size; /* +0x0002 */ unsigned char DeviceObject[4]; /* +0x0004 ca 11 00 00 */ unsigned char Vpb[4]; /* +0x0008 f8 11 00 00 */ void *FsContext; /* +0x000c */ void *FsContext2; /* +0x0010 */ unsigned char SectionObjectPointer[4]; /* +0x0014 4d 17 00 00 */ void *PrivateCacheMap; /* +0x0018 */ long FinalStatus; /* +0x001c */ unsigned char RelatedFileObject[4]; /* +0x0020 e0 11 00 00 */ unsigned char LockOperation; /* +0x0024 */ unsigned char DeletePending; /* +0x0025 */ unsigned char ReadAccess; /* +0x0026 */ unsigned char WriteAccess; /* +0x0027 */ unsigned char DeleteAccess; /* +0x0028 */ unsigned char SharedRead; /* +0x0029 */ unsigned char SharedWrite; /* +0x002a */ unsigned char SharedDelete; /* +0x002b */ unsigned long Flags; /* +0x002c */ unsigned char FileName[8]; /* +0x0030 a0 10 00 00 */ unsigned char CurrentByteOffset[8]; /* +0x0038 34 10 00 00 */ unsigned long Waiters; /* +0x0040 */ unsigned long Busy; /* +0x0044 */ void *LastLock; /* +0x0048 */ unsigned char Lock[16]; /* +0x004c 4b 11 00 00 */ unsigned char Event[16]; /* +0x005c 4b 11 00 00 */ unsigned char CompletionContext[4]; /* +0x006c 4f 17 00 00 */ unsigned long IrpListLock; /* +0x0070 */ unsigned char IrpList[8]; /* +0x0074 80 10 00 00 */ void *FileObjectExtension; /* +0x007c */ }; struct RdCtrlDeviceParameters { unsigned char m_RdDriver[4]; /* +0x0000 92 15 00 00 */ unsigned char m_RdFdo[4]; /* +0x0004 80 14 00 00 */ unsigned char m_NextLowerDeviceObject[4]; /* +0x0008 ca 11 00 00 */ unsigned char m_PhysicalDeviceObject[4]; /* +0x000c ca 11 00 00 */ unsigned char m_DeviceName[4]; /* +0x0010 10 10 00 00 */ void *m_ProcessId; /* +0x0014 */ }; enum WDF_PNP_IRP_STATE { WdfPnpIrpProcessStage__NewIrp = 0, WdfPnpIrpProcessStage__PreProcessed = 1, WdfPnpIrpProcessStage__ProcessedByHost = 2, WdfPnpIrpProcessStage__PostProcessed = 3, WdfPnpIrpProcessStage__ForwardAndForget = 4, WdfPnpIrpProcessStage__CompletedByLowerDevice = 5, WdfPnpIrpProcessStage__PreCompleted = 6, WdfPnpIrpProcessStage__CompletedByHost = 7, WdfPnpIrpProcessStage__PostCompleted = 8, WdfPnpIrpProcessStage__Max = 9 }; struct RdDeviceSymbolicLinkParameters { unsigned char m_Pdo[4]; /* +0x0000 ca 11 00 00 */ unsigned char m_SymbolicLink[4]; /* +0x0004 71 04 00 00 */ unsigned char m_SymbolicLinkCch[4]; /* +0x0008 75 00 00 00 */ unsigned char m_ReferenceString[4]; /* +0x000c 71 04 00 00 */ unsigned char m_ReferenceStringCch[4]; /* +0x0010 75 00 00 00 */ unsigned char m_PdoName[4]; /* +0x0014 71 04 00 00 */ }; struct RdDeviceInterfaceParameters { unsigned char m_Pdo[4]; /* +0x0000 ca 11 00 00 */ unsigned char m_InterfaceGuid[4]; /* +0x0004 69 12 00 00 */ unsigned char m_ReferenceString[4]; /* +0x0008 71 04 00 00 */ }; struct RdRemoteInterfaceRegistrationParameters { unsigned char m_RdFdo[4]; /* +0x0000 80 14 00 00 */ unsigned char m_DriverObject[4]; /* +0x0004 f4 11 00 00 */ unsigned char m_InterfaceGuid[4]; /* +0x0008 15 10 00 00 */ unsigned char m_ExistingInterfaces; /* +0x000c */ unsigned char m_DeviceContext[4]; /* +0x0010 85 13 00 00 */ }; struct WUDF_DEVICE_CONTEXT__ { unsigned char unused[4]; /* +0x0000 74 00 00 00 */ }; struct RdTargetDeviceRegistrationParameters { unsigned char m_RdFdo[4]; /* +0x0000 80 14 00 00 */ unsigned char m_DriverObject[4]; /* +0x0004 f4 11 00 00 */ void *m_hTarget; /* +0x0008 */ unsigned long long m_TargetContext; /* +0x0010 */ }; enum RdIoctlMethod { RdIoctlMethodBuffered = 0, RdIoctlMethodDirectToHw = 1, RdIoctlMethodDirectFromHw = 2, RdIoctlMethodNeither = 3, RdIoctlMethodMax = 4 }; enum RdIrpTransferMode { RdIrpTransferModeUnknown = 0, RdIrpTransferModeBuffered = 1, RdIrpTransferModeDirect = 2, RdIrpTransferModeNeither = 3, RdIrpTransferModeMax = 4 }; enum RdIrpBufferFlags { RdIrpBufferFlagsNone = 0, RdIrpBufferFlagsTransferToHost = 1, RdIrpBufferFlagsTransferFromHost = 2, RdIrpBufferFlagsEnableHostMapping = 4, RdIrpBufferFlagsLargerThanCopyThreshold = 8, RdIrpBufferFlagsIntermediateSystemBuffer = 16, RdIrpBufferFlagsIntermediateMdl = 32, RdIrpBufferFlagsFreeIntermediateBuffer = 64, RdIrpBufferFlagsTransferCompleted = 128 }; struct _RdIrpContext { unsigned char MajorFunction; /* +0x0000 */ unsigned char MinorFunction; /* +0x0001 */ unsigned char MessageType[2]; /* +0x0002 a2 16 00 00 */ unsigned char Device[4]; /* +0x0004 80 14 00 00 */ unsigned char Message[4]; /* +0x0008 a0 14 00 00 */ unsigned char CancelWorkItem[4]; /* +0x000c 87 15 00 00 */ /* unsigned char Create[0]; +0x0010 8f 18 00 00 */ /* unsigned char Close[0]; +0x0010 90 18 00 00 */ /* unsigned char Cleanup[0]; +0x0010 91 18 00 00 */ /* unsigned char Io[0]; +0x0010 92 18 00 00 */ /* unsigned char Pnp[-16]; +0x0010 93 18 00 00 */ unsigned char IrpStack[36]; /* +0x0000 dd 11 00 00 */ }; struct RdSafeMdl { unsigned char m_OriginalMdl[4]; /* +0x0000 c6 11 00 00 */ unsigned char m_FirstPageMdl[32]; /* +0x0004 a4 18 00 00 */ unsigned char m_LastPageMdl[32]; /* +0x0024 a4 18 00 00 */ unsigned char *m_FirstPageCopy; /* +0x0044 */ unsigned char *m_LastPageCopy; /* +0x0048 */ unsigned char m_SafeMdl[28]; /* +0x004c c5 11 00 00 */ /* unsigned char m_SafePfns[0]; +0x0068 a5 18 00 00 */ }; struct RdWaitWake { unsigned char m_RdFdo[4]; /* +0x0000 80 14 00 00 */ unsigned char m_WWIrpIsBeingProcessed[4]; /* +0x0004 1f 10 00 00 */ unsigned char m_PendingWaitWakeIrp[4]; /* +0x0008 ba 18 00 00 */ unsigned char m_CompletionSynchronizer[8]; /* +0x000c bb 18 00 00 */ unsigned char m_AcceptingNewWaitWake; /* +0x0014 */ unsigned char m_AcceptingNewWWLock[16]; /* +0x0018 bc 18 00 00 */ }; struct RdEventBasedLock { unsigned char m_Event[16]; /* +0x0000 4b 11 00 00 */ }; enum RdIrpBufferSource { RdIrpBufferSourceNone = 0, RdIrpBufferSourceMdl = 1, RdIrpBufferSourceSystemBuffer = 2, RdIrpBufferSourceUserBuffer = 3 }; struct RD_IO_TRANSFER_DESCRIPTOR { unsigned char Source[16]; /* +0x0000 d0 18 00 00 */ }; struct RD_IO_TRANSFER_DESCRIPTOR:: { /* unsigned char Mdl[0]; +0x0000 c6 11 00 00 */ void *Address; /* +0x0000 */ }; enum WDF_METHOD_NEITHER_ACTION_TYPE { WdfMethodNeitherAction_Reject = 0, WdfMethodNeitherAction_Copy = 1, WdfMethodNeitherAction_Max = 2 }; enum WDF_KERNEL_MODE_CLIENT_POLICY_TYPE { WdfRejectKernelModeClients = 0, WdfAllowKernelModeClients = 1, WdfKernelModeClientPolicyMax = 2 }; enum WDF_DIRECT_HARDWARE_ACCESS_TYPE { WdfRejectDirectHardwareAccess = 0, WdfAllowDirectHardwareAccess = 1, WdfDirectHardwareAccessMax = 2 }; enum WDF_REGISTER_ACCESS_MODE_TYPE { WdfRegisterAccessUsingSystemCall = 0, WdfRegisterAccessUsingUserModeMapping = 1, WdfRegisterAccessMax = 2 }; enum WDF_FILE_OBJECT_POLICY_TYPE { WdfRejectNullAndUnknownFileObjects = 0, WdfAllowNullAndUnknownFileObjects = 1, WdfFileObjectPolicyMax = 2 }; enum WDF_FS_CONTEXT_USE_POLICY_TYPE { WdfCanUseFsContext = 0, WdfCanUseFsContext2 = 1, WdfCannotUseFsContexts = 2, WdfFsContextUsePolicyMax = 3, WdfDefaultFsContextUsePolicy = 4 }; enum _WUDF_IRP_BUFFER_INDEX { IrpBufferIndexPrimary = 0, IrpBufferIndexSecondary = 1, IrpBufferIndexMax = 2 }; enum _POWER_STATE_TYPE { SystemPowerState = 0, DevicePowerState = 1 }; enum _FILE_INFORMATION_CLASS { FileDirectoryInformation = 1, FileFullDirectoryInformation = 2, FileBothDirectoryInformation = 3, FileBasicInformation = 4, FileStandardInformation = 5, FileInternalInformation = 6, FileEaInformation = 7, FileAccessInformation = 8, FileNameInformation = 9, FileRenameInformation = 10, FileLinkInformation = 11, FileNamesInformation = 12, FileDispositionInformation = 13, FilePositionInformation = 14, FileFullEaInformation = 15, FileModeInformation = 16, FileAlignmentInformation = 17, FileAllInformation = 18, FileAllocationInformation = 19, FileEndOfFileInformation = 20, FileAlternateNameInformation = 21, FileStreamInformation = 22, FilePipeInformation = 23, FilePipeLocalInformation = 24, FilePipeRemoteInformation = 25, FileMailslotQueryInformation = 26, FileMailslotSetInformation = 27, FileCompressionInformation = 28, FileObjectIdInformation = 29, FileCompletionInformation = 30, FileMoveClusterInformation = 31, FileQuotaInformation = 32, FileReparsePointInformation = 33, FileNetworkOpenInformation = 34, FileAttributeTagInformation = 35, FileTrackingInformation = 36, FileIdBothDirectoryInformation = 37, FileIdFullDirectoryInformation = 38, FileValidDataLengthInformation = 39, FileShortNameInformation = 40, FileIoCompletionNotificationInformation = 41, FileIoStatusBlockRangeInformation = 42, FileIoPriorityHintInformation = 43, FileSfioReserveInformation = 44, FileSfioVolumeInformation = 45, FileHardLinkInformation = 46, FileProcessIdsUsingFileInformation = 47, FileNormalizedNameInformation = 48, FileNetworkPhysicalNameInformation = 49, FileIdGlobalTxDirectoryInformation = 50, FileIsRemoteDeviceInformation = 51, FileAttributeCacheInformation = 52, FileNumaNodeInformation = 53, FileStandardLinkInformation = 54, FileRemoteProtocolInformation = 55, FileRenameInformationBypassAccessCheck = 56, FileLinkInformationBypassAccessCheck = 57, FileIntegrityStreamInformation = 58, FileVolumeNameInformation = 59, FileMaximumInformation = 60 }; enum _WUDF_IRP_COPY_DIRECTION { CopyDirectionToHost = 1, CopyDirectionFromHost = 2 }; enum RdFdoDevice::UnmapIoBuffersReturnValue { UnmapIoBuffersDeferred = 0, UnmapIoBuffersComplete = 1 }; struct RdFdoDeviceParameters { unsigned char RdDriver[4]; /* +0x0000 92 15 00 00 */ unsigned char RdDeviceName[4]; /* +0x0004 10 10 00 00 */ unsigned char PhysicalDeviceObject[4]; /* +0x0008 ca 11 00 00 */ }; struct RdUsbSelectiveSuspend { unsigned char m_RdFdo[80]; /* +0x0000 80 14 00 00 */ }; struct _ALPC_SECURITY_ATTR { unsigned long Flags; /* +0x0000 */ unsigned char QoS[4]; /* +0x0004 ec 15 00 00 */ void *ContextHandle; /* +0x0008 */ }; struct WudfFdoCreateContextStorageParameters { unsigned char m_FileObject[4]; /* +0x0000 e0 11 00 00 */ }; struct RdRegisterResourceInfo { unsigned char m_StartPa[8]; /* +0x0000 34 10 00 00 */ unsigned long m_Length; /* +0x0008 */ void *m_StartSystemVa; /* +0x000c */ void *m_EndSystemVa; /* +0x0010 */ unsigned long m_MappedLength; /* +0x0014 */ void *m_StartUsermodeVa; /* +0x0018 */ unsigned char m_Mdl[4]; /* +0x001c c6 11 00 00 */ }; struct RdPortResourceInfo { unsigned char m_StartPa[8]; /* +0x0000 34 10 00 00 */ unsigned char m_EndPa[8]; /* +0x0008 34 10 00 00 */ unsigned long m_Length; /* +0x0010 */ }; enum _WDF_DEVICE_HWACCESS_TARGET_TYPE { WdfDeviceHwAccessTargetTypeInvalid = 0, WdfDeviceHwAccessTargetTypeRegister = 1, WdfDeviceHwAccessTargetTypeRegisterBuffer = 2, WdfDeviceHwAccessTargetTypePort = 3, WdfDeviceHwAccessTargetTypePortBuffer = 4, WdfDeviceHwAccessTargetTypeMaximum = 5 }; enum _WDF_DEVICE_HWACCESS_TARGET_SIZE { WdfDeviceHwAccessTargetSizeInvalid = 0, WdfDeviceHwAccessTargetSizeUchar = 1, WdfDeviceHwAccessTargetSizeUshort = 2, WdfDeviceHwAccessTargetSizeUlong = 3, WdfDeviceHwAccessTargetSizeUlong64 = 4, WdfDeviceHwAccessTargetSizeMaximum = 5 }; struct RdCmResources { unsigned char m_RdFdoDevice[4]; /* +0x0000 80 14 00 00 */ unsigned char m_Raw[4]; /* +0x0004 b4 17 00 00 */ unsigned char m_Translated[4]; /* +0x0008 b4 17 00 00 */ unsigned char m_RegisterResourceTable[4]; /* +0x000c 3e 1a 00 00 */ unsigned long m_RegisterResourceTableSizeCe; /* +0x0010 */ unsigned char m_PortResourceTable[4]; /* +0x0014 3f 1a 00 00 */ unsigned long m_PortResourceTableSizeCe; /* +0x0018 */ unsigned char m_Mutex[32]; /* +0x001c 49 11 00 00 */ }; struct _CM_RESOURCE_LIST { unsigned long Count; /* +0x0000 */ unsigned char List[32]; /* +0x0004 69 1a 00 00 */ }; enum RdInterruptAcknowledgement { RdInterruptAcknowledgeInit = 0, RdInterruptAcknowledgeClaimed = 1, RdInterruptAcknowledgeNotClaimed = 2, RdInterruptAcknowledgeForceDisconnect = 3 }; enum _CM_SHARE_DISPOSITION { CmResourceShareUndetermined = 0, CmResourceShareDeviceExclusive = 1, CmResourceShareDriverExclusive = 2, CmResourceShareShared = 3 }; struct RdInterrupt { unsigned char m_RdFdoDevice[4]; /* +0x0000 80 14 00 00 */ unsigned char m_WudfInterruptContext[4]; /* +0x0004 6e 1a 00 00 */ unsigned char m_InterruptEvent[4]; /* +0x0008 4e 11 00 00 */ unsigned char m_Interrupt[4]; /* +0x000c 70 1a 00 00 */ unsigned long m_InterruptSpinLock; /* +0x0010 */ unsigned char m_OldIrql; /* +0x0014 */ unsigned char m_SynchronizeIrql[1]; /* +0x0015 48 10 00 00 */ unsigned char m_ConnectInProgress; /* +0x0016 */ unsigned char m_DisconnectInProgress; /* +0x0017 */ unsigned char m_Dpc[32]; /* +0x0018 ec 11 00 00 */ unsigned char m_Policy[4]; /* +0x0038 54 13 00 00 */ unsigned char m_Priority[4]; /* +0x003c 56 13 00 00 */ unsigned char m_Processors[12]; /* +0x0040 57 13 00 00 */ unsigned char m_SetPolicy; /* +0x004c */ unsigned char m_AddedToList; /* +0x004d */ unsigned char m_Connected; /* +0x004e */ unsigned char m_ResourcesAssigned; /* +0x004f */ unsigned char m_InterruptInfo[56]; /* +0x0050 49 13 00 00 */ unsigned char m_PnpList[8]; /* +0x0088 80 10 00 00 */ unsigned long m_MessageNumber; /* +0x0090 */ unsigned char m_Mutex[32]; /* +0x0094 49 11 00 00 */ unsigned char m_TranslatedDescriptor[4]; /* +0x00b4 a4 19 00 00 */ unsigned char m_PnpRundownEvent[16]; /* +0x00b8 4b 11 00 00 */ unsigned char m_AcknowledgementEvent[16]; /* +0x00c8 4b 11 00 00 */ unsigned char m_Acknowledgement[1]; /* +0x00d8 72 1a 00 00 */ unsigned char m_PassiveHandling; /* +0x00d9 */ unsigned char m_ShareVector[4]; /* +0x00dc 74 1a 00 00 */ }; struct tagCABSTR { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 e6 10 00 00 */ }; enum _INTERFACE_TYPE { InterfaceTypeUndefined = -1, Internal = 0, Isa = 1, Eisa = 2, MicroChannel = 3, TurboChannel = 4, PCIBus = 5, VMEBus = 6, NuBus = 7, PCMCIABus = 8, CBus = 9, MPIBus = 10, MPSABus = 11, ProcessorInternal = 12, InternalPowerBus = 13, PNPISABus = 14, PNPBus = 15, Vmcs = 16, ACPIBus = 17, MaximumInterfaceType = 18 }; struct _IO_RESOURCE_REQUIREMENTS_LIST { unsigned long ListSize; /* +0x0000 */ unsigned char InterfaceType[4]; /* +0x0004 e8 1a 00 00 */ unsigned long BusNumber; /* +0x0008 */ unsigned long SlotNumber; /* +0x000c */ unsigned char Reserved[12]; /* +0x0010 45 10 00 00 */ unsigned long AlternativeLists; /* +0x001c */ unsigned char List[40]; /* +0x0020 ea 1a 00 00 */ }; struct _s__RTTIBaseClassDescriptor2 { unsigned char pTypeDescriptor[4]; /* +0x0000 f0 1a 00 00 */ unsigned long numContainedBases; /* +0x0004 */ unsigned char where[12]; /* +0x0008 f1 1a 00 00 */ unsigned long attributes; /* +0x0014 */ unsigned char pClassDescriptor[4]; /* +0x0018 f4 1a 00 00 */ }; struct tagCAUL { unsigned long cElems; /* +0x0000 */ unsigned long *pElems; /* +0x0004 */ }; struct tagCASCODE { unsigned long cElems; /* +0x0000 */ long *pElems; /* +0x0004 */ }; struct threadlocaleinfostruct { unsigned char refcount[4]; /* +0x0000 74 00 00 00 */ unsigned char lc_codepage[4]; /* +0x0004 75 00 00 00 */ unsigned char lc_collate_cp[4]; /* +0x0008 75 00 00 00 */ unsigned char lc_handle[24]; /* +0x000c fb 1a 00 00 */ unsigned char lc_id[180]; /* +0x0024 fd 1a 00 00 */ }; struct _s__RTTICompleteObjectLocator { unsigned long signature; /* +0x0000 */ unsigned long offset; /* +0x0004 */ unsigned long cdOffset; /* +0x0008 */ unsigned char pTypeDescriptor[4]; /* +0x000c f0 1a 00 00 */ unsigned char pClassDescriptor[4]; /* +0x0010 f4 1a 00 00 */ }; struct _POWER_COMPLETE_WORK_ITEM { unsigned char ControlDevice[4]; /* +0x0000 e5 18 00 00 */ unsigned char MinorFunction; /* +0x0004 */ unsigned char PowerState[4]; /* +0x0008 5f 17 00 00 */ unsigned char IoStatus[8]; /* +0x000c 99 11 00 00 */ unsigned char PwrIrpCompletionMsg[4]; /* +0x0014 a0 14 00 00 */ unsigned char WorkItem[4]; /* +0x0018 6b 15 00 00 */ }; struct _RD_DEVICE_INTERFACE_STORE_PARAMETERS { unsigned char InterfaceGUID[16]; /* +0x0000 13 10 00 00 */ unsigned long RefStringCch; /* +0x0010 */ /* unsigned char RefString[0]; +0x0014 0c 1b 00 00 */ }; enum _tagPARSEACTION { PARSE_CANONICALIZE = 1, PARSE_FRIENDLY = 2, PARSE_SECURITY_URL = 3, PARSE_ROOTDOCUMENT = 4, PARSE_DOCUMENT = 5, PARSE_ANCHOR = 6, PARSE_ENCODE_IS_UNESCAPE = 7, PARSE_DECODE_IS_ESCAPE = 8, PARSE_PATH_FROM_URL = 9, PARSE_URL_FROM_PATH = 10, PARSE_MIME = 11, PARSE_SERVER = 12, PARSE_SCHEMA = 13, PARSE_SITE = 14, PARSE_DOMAIN = 15, PARSE_LOCATION = 16, PARSE_SECURITY_DOMAIN = 17, PARSE_ESCAPE = 18, PARSE_UNESCAPE = 19 }; struct _s__RTTIClassHierarchyDescriptor { unsigned long signature; /* +0x0000 */ unsigned long attributes; /* +0x0004 */ unsigned long numBaseClasses; /* +0x0008 */ unsigned char pBaseClassArray[4]; /* +0x000c 13 1b 00 00 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_68 { unsigned char arrayOfBaseClassDescriptors[69]; /* +0x0000 18 1b 00 00 */ }; struct tagCABOOL { unsigned long cElems; /* +0x0000 */ short *pElems; /* +0x0004 */ }; struct _DISPATCHER_HEADER { unsigned char Type; /* +0x0000 */ unsigned char TimerControlFlags; /* +0x0001 */ /* unsigned char Absolute[0]; +0x0001 06 11 00 00 */ /* unsigned char Wake[0]; +0x0001 1d 1b 00 00 */ /* unsigned char Coalescable[0]; +0x0001 1e 1b 00 00 */ /* unsigned char KeepShifting[0]; +0x0001 1f 1b 00 00 */ /* unsigned char EncodedTolerableDelay[0]; +0x0001 20 1b 00 00 */ unsigned char Abandoned; /* +0x0001 */ unsigned char Signalling; /* +0x0001 */ unsigned char ThreadControlFlags; /* +0x0002 */ /* unsigned char CycleProfiling[0]; +0x0002 06 11 00 00 */ /* unsigned char CounterProfiling[0]; +0x0002 1d 1b 00 00 */ /* unsigned char GroupScheduling[0]; +0x0002 1e 1b 00 00 */ /* unsigned char AffinitySet[0]; +0x0002 1f 1b 00 00 */ /* unsigned char Reserved[0]; +0x0002 20 1b 00 00 */ unsigned char Hand; /* +0x0002 */ unsigned char Size; /* +0x0002 */ unsigned char TimerMiscFlags; /* +0x0003 */ /* unsigned char Index[0]; +0x0003 06 11 00 00 */ /* unsigned char Processor[0]; +0x0003 21 1b 00 00 */ /* unsigned char Inserted[0]; +0x0003 22 1b 00 00 */ /* unsigned char Expired[0]; +0x0003 23 1b 00 00 */ unsigned char DebugActive; /* +0x0003 */ unsigned char DpcActive; /* +0x0003 */ unsigned char Lock[4]; /* +0x0000 1f 10 00 00 */ long SignalState; /* +0x0004 */ unsigned char WaitListHead[8]; /* +0x0008 80 10 00 00 */ }; struct _DISPATCHER_HEADER:: { unsigned char Type; /* +0x0000 */ unsigned char TimerControlFlags; /* +0x0001 */ /* unsigned char Absolute[0]; +0x0001 06 11 00 00 */ /* unsigned char Wake[0]; +0x0001 1d 1b 00 00 */ /* unsigned char Coalescable[0]; +0x0001 1e 1b 00 00 */ /* unsigned char KeepShifting[0]; +0x0001 1f 1b 00 00 */ /* unsigned char EncodedTolerableDelay[0]; +0x0001 20 1b 00 00 */ unsigned char Abandoned; /* +0x0001 */ unsigned char Signalling; /* +0x0001 */ unsigned char ThreadControlFlags; /* +0x0002 */ /* unsigned char CycleProfiling[0]; +0x0002 06 11 00 00 */ /* unsigned char CounterProfiling[0]; +0x0002 1d 1b 00 00 */ /* unsigned char GroupScheduling[0]; +0x0002 1e 1b 00 00 */ /* unsigned char AffinitySet[0]; +0x0002 1f 1b 00 00 */ /* unsigned char Reserved[0]; +0x0002 20 1b 00 00 */ unsigned char Hand; /* +0x0002 */ unsigned char Size; /* +0x0002 */ unsigned char TimerMiscFlags; /* +0x0003 */ /* unsigned char Index[0]; +0x0003 06 11 00 00 */ /* unsigned char Processor[0]; +0x0003 21 1b 00 00 */ /* unsigned char Inserted[0]; +0x0003 22 1b 00 00 */ /* unsigned char Expired[0]; +0x0003 23 1b 00 00 */ unsigned char DebugActive; /* +0x0003 */ unsigned char DpcActive; /* +0x0003 */ unsigned char Lock[4]; /* +0x0000 1f 10 00 00 */ }; struct _DISPATCHER_HEADER:::: { unsigned char Type; /* +0x0000 */ unsigned char TimerControlFlags; /* +0x0001 */ /* unsigned char Absolute[0]; +0x0001 06 11 00 00 */ /* unsigned char Wake[0]; +0x0001 1d 1b 00 00 */ /* unsigned char Coalescable[0]; +0x0001 1e 1b 00 00 */ /* unsigned char KeepShifting[0]; +0x0001 1f 1b 00 00 */ /* unsigned char EncodedTolerableDelay[0]; +0x0001 20 1b 00 00 */ unsigned char Abandoned; /* +0x0001 */ unsigned char Signalling; /* +0x0001 */ unsigned char ThreadControlFlags; /* +0x0002 */ /* unsigned char CycleProfiling[0]; +0x0002 06 11 00 00 */ /* unsigned char CounterProfiling[0]; +0x0002 1d 1b 00 00 */ /* unsigned char GroupScheduling[0]; +0x0002 1e 1b 00 00 */ /* unsigned char AffinitySet[0]; +0x0002 1f 1b 00 00 */ /* unsigned char Reserved[0]; +0x0002 20 1b 00 00 */ unsigned char Hand; /* +0x0002 */ unsigned char Size; /* +0x0002 */ unsigned char TimerMiscFlags; /* +0x0003 */ /* unsigned char Index[0]; +0x0003 06 11 00 00 */ /* unsigned char Processor[0]; +0x0003 21 1b 00 00 */ /* unsigned char Inserted[0]; +0x0003 22 1b 00 00 */ /* unsigned char Expired[0]; +0x0003 23 1b 00 00 */ unsigned char DebugActive; /* +0x0003 */ unsigned char DpcActive; /* +0x0003 */ }; struct _DISPATCHER_HEADER:::::: { unsigned char TimerControlFlags; /* +0x0000 */ /* unsigned char Absolute[0]; +0x0000 06 11 00 00 */ /* unsigned char Wake[0]; +0x0000 1d 1b 00 00 */ /* unsigned char Coalescable[0]; +0x0000 1e 1b 00 00 */ /* unsigned char KeepShifting[0]; +0x0000 1f 1b 00 00 */ /* unsigned char EncodedTolerableDelay[0]; +0x0000 20 1b 00 00 */ unsigned char Abandoned; /* +0x0000 */ unsigned char Signalling; /* +0x0000 */ }; struct _DISPATCHER_HEADER:::::::: { unsigned char TimerControlFlags; /* +0x0000 */ /* unsigned char Absolute[0]; +0x0000 06 11 00 00 */ /* unsigned char Wake[0]; +0x0000 1d 1b 00 00 */ /* unsigned char Coalescable[0]; +0x0000 1e 1b 00 00 */ /* unsigned char KeepShifting[0]; +0x0000 1f 1b 00 00 */ unsigned char EncodedTolerableDelay[1]; /* +0x0000 20 1b 00 00 */ }; struct _DISPATCHER_HEADER:::::::::: { /* unsigned char Absolute[0]; +0x0000 06 11 00 00 */ /* unsigned char Wake[0]; +0x0000 1d 1b 00 00 */ /* unsigned char Coalescable[0]; +0x0000 1e 1b 00 00 */ /* unsigned char KeepShifting[0]; +0x0000 1f 1b 00 00 */ unsigned char EncodedTolerableDelay[1]; /* +0x0000 20 1b 00 00 */ }; struct _DISPATCHER_HEADER:::::: { unsigned char ThreadControlFlags; /* +0x0000 */ /* unsigned char CycleProfiling[0]; +0x0000 06 11 00 00 */ /* unsigned char CounterProfiling[0]; +0x0000 1d 1b 00 00 */ /* unsigned char GroupScheduling[0]; +0x0000 1e 1b 00 00 */ /* unsigned char AffinitySet[0]; +0x0000 1f 1b 00 00 */ /* unsigned char Reserved[0]; +0x0000 20 1b 00 00 */ unsigned char Hand; /* +0x0000 */ unsigned char Size; /* +0x0000 */ }; struct _DISPATCHER_HEADER:::::::: { unsigned char ThreadControlFlags; /* +0x0000 */ /* unsigned char CycleProfiling[0]; +0x0000 06 11 00 00 */ /* unsigned char CounterProfiling[0]; +0x0000 1d 1b 00 00 */ /* unsigned char GroupScheduling[0]; +0x0000 1e 1b 00 00 */ /* unsigned char AffinitySet[0]; +0x0000 1f 1b 00 00 */ unsigned char Reserved[1]; /* +0x0000 20 1b 00 00 */ }; struct _DISPATCHER_HEADER:::::::::: { /* unsigned char CycleProfiling[0]; +0x0000 06 11 00 00 */ /* unsigned char CounterProfiling[0]; +0x0000 1d 1b 00 00 */ /* unsigned char GroupScheduling[0]; +0x0000 1e 1b 00 00 */ /* unsigned char AffinitySet[0]; +0x0000 1f 1b 00 00 */ unsigned char Reserved[1]; /* +0x0000 20 1b 00 00 */ }; struct _DISPATCHER_HEADER:::::: { unsigned char TimerMiscFlags; /* +0x0000 */ /* unsigned char Index[0]; +0x0000 06 11 00 00 */ /* unsigned char Processor[0]; +0x0000 21 1b 00 00 */ /* unsigned char Inserted[0]; +0x0000 22 1b 00 00 */ /* unsigned char Expired[0]; +0x0000 23 1b 00 00 */ unsigned char DebugActive; /* +0x0000 */ unsigned char DpcActive; /* +0x0000 */ }; struct _DISPATCHER_HEADER:::::::: { unsigned char TimerMiscFlags; /* +0x0000 */ /* unsigned char Index[0]; +0x0000 06 11 00 00 */ /* unsigned char Processor[0]; +0x0000 21 1b 00 00 */ /* unsigned char Inserted[0]; +0x0000 22 1b 00 00 */ unsigned char Expired[1]; /* +0x0000 23 1b 00 00 */ }; struct _DISPATCHER_HEADER:::::::::: { /* unsigned char Index[0]; +0x0000 06 11 00 00 */ /* unsigned char Processor[0]; +0x0000 21 1b 00 00 */ /* unsigned char Inserted[0]; +0x0000 22 1b 00 00 */ unsigned char Expired[1]; /* +0x0000 23 1b 00 00 */ }; struct _DISPATCHER_HEADER:::::::: { unsigned char DebugActive; /* +0x0000 */ }; enum _tagINTERNETFEATURELIST { FEATURE_OBJECT_CACHING = 0, FEATURE_ZONE_ELEVATION = 1, FEATURE_MIME_HANDLING = 2, FEATURE_MIME_SNIFFING = 3, FEATURE_WINDOW_RESTRICTIONS = 4, FEATURE_WEBOC_POPUPMANAGEMENT = 5, FEATURE_BEHAVIORS = 6, FEATURE_DISABLE_MK_PROTOCOL = 7, FEATURE_LOCALMACHINE_LOCKDOWN = 8, FEATURE_SECURITYBAND = 9, FEATURE_RESTRICT_ACTIVEXINSTALL = 10, FEATURE_VALIDATE_NAVIGATE_URL = 11, FEATURE_RESTRICT_FILEDOWNLOAD = 12, FEATURE_ADDON_MANAGEMENT = 13, FEATURE_PROTOCOL_LOCKDOWN = 14, FEATURE_HTTP_USERNAME_PASSWORD_DISABLE = 15, FEATURE_SAFE_BINDTOOBJECT = 16, FEATURE_UNC_SAVEDFILECHECK = 17, FEATURE_GET_URL_DOM_FILEPATH_UNENCODED = 18, FEATURE_TABBED_BROWSING = 19, FEATURE_SSLUX = 20, FEATURE_DISABLE_NAVIGATION_SOUNDS = 21, FEATURE_DISABLE_LEGACY_COMPRESSION = 22, FEATURE_FORCE_ADDR_AND_STATUS = 23, FEATURE_XMLHTTP = 24, FEATURE_DISABLE_TELNET_PROTOCOL = 25, FEATURE_FEEDS = 26, FEATURE_BLOCK_INPUT_PROMPTS = 27, FEATURE_ENTRY_COUNT = 28 }; enum tagCALLCONV { CC_FASTCALL = 0, CC_CDECL = 1, CC_MSCPASCAL = 2, CC_PASCAL = 2, CC_MACPASCAL = 3, CC_STDCALL = 4, CC_FPFASTCALL = 5, CC_SYSCALL = 6, CC_MPWCDECL = 7, CC_MPWPASCAL = 8, CC_MAX = 9 }; struct _DEVICE_INTERFACE_CHANGE_NOTIFICATION { unsigned short Version; /* +0x0000 */ unsigned short Size; /* +0x0002 */ unsigned char Event[16]; /* +0x0004 13 10 00 00 */ unsigned char InterfaceClassGuid[16]; /* +0x0014 13 10 00 00 */ unsigned char SymbolicLinkName[4]; /* +0x0024 e3 10 00 00 */ }; struct _WUDFMESSAGE_REMOTE_INTERFACE_ARRIVAL_REPLY { unsigned char Header[8]; /* +0x0000 6e 13 00 00 */ unsigned long long InterfaceContext; /* +0x0008 */ }; enum __MIDL_ICodeInstall_0001 { CIP_DISK_FULL = 0, CIP_ACCESS_DENIED = 1, CIP_NEWER_VERSION_EXISTS = 2, CIP_OLDER_VERSION_EXISTS = 3, CIP_NAME_CONFLICT = 4, CIP_TRUST_VERIFICATION_COMPONENT_MISSING = 5, CIP_EXE_SELF_REGISTERATION_TIMEOUT = 6, CIP_UNSAFE_TO_ABORT = 7, CIP_NEED_REBOOT = 8, CIP_NEED_REBOOT_UI_PERMISSION = 9 }; struct _GROUP_AFFINITY { unsigned long Mask; /* +0x0000 */ unsigned short Group; /* +0x0004 */ unsigned char Reserved[6]; /* +0x0006 48 1b 00 00 */ }; struct _KAPC { unsigned char Type; /* +0x0000 */ unsigned char SpareByte0; /* +0x0001 */ unsigned char Size; /* +0x0002 */ unsigned char SpareByte1; /* +0x0003 */ unsigned long SpareLong0; /* +0x0004 */ unsigned char Thread[4]; /* +0x0008 30 11 00 00 */ unsigned char ApcListEntry[8]; /* +0x000c 80 10 00 00 */ unsigned char KernelRoutine[4]; /* +0x0014 50 1b 00 00 */ unsigned char RundownRoutine[4]; /* +0x0018 53 1b 00 00 */ /* unsigned char NormalRoutine[-8]; +0x001c 4c 1b 00 00 */ unsigned char Reserved[12]; /* +0x0014 54 1b 00 00 */ void *NormalContext; /* +0x0020 */ void *SystemArgument1; /* +0x0024 */ void *SystemArgument2; /* +0x0028 */ char ApcStateIndex; /* +0x002c */ char ApcMode; /* +0x002d */ unsigned char Inserted; /* +0x002e */ }; struct $_TypeDescriptor$_extraBytes_24 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[24]; /* +0x0008 58 1b 00 00 */ }; struct _TEB_ACTIVE_FRAME { unsigned long Flags; /* +0x0000 */ unsigned char Previous[4]; /* +0x0004 a7 10 00 00 */ unsigned char Context[4]; /* +0x0008 5e 1b 00 00 */ }; struct _ACCESS_REASONS { unsigned char Data[128]; /* +0x0000 61 1b 00 00 */ }; struct $_TypeDescriptor$_extraBytes_57 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[57]; /* +0x0008 65 1b 00 00 */ }; struct tagBLOB { unsigned long cbSize; /* +0x0000 */ unsigned char *pBlobData; /* +0x0004 */ }; struct _WHEA_ERROR_PACKET_FLAGS { /* unsigned char PreviousError[0]; +0x0000 3b 10 00 00 */ /* unsigned char Reserved1[0]; +0x0000 3c 10 00 00 */ /* unsigned char HypervisorError[0]; +0x0000 3d 10 00 00 */ /* unsigned char Simulated[0]; +0x0000 3e 10 00 00 */ /* unsigned char PlatformPfaControl[0]; +0x0000 3f 10 00 00 */ /* unsigned char PlatformDirectedOffline[0]; +0x0000 40 10 00 00 */ /* unsigned char Reserved2[0]; +0x0000 6a 1b 00 00 */ unsigned long AsULONG; /* +0x0000 */ }; enum tagCOWAIT_FLAGS { COWAIT_WAITALL = 1, COWAIT_ALERTABLE = 2, COWAIT_INPUTAVAILABLE = 4, COWAIT_DISPATCH_CALLS = 8, COWAIT_DISPATCH_WINDOW_MESSAGES = 16, REAL_COWAIT_ENABLECALLREENTRANCY = 8, COWAIT_ENABLEWINDOWMESSAGES = 16, COWAIT_ENABLECALLREENTRANCY = 24 }; struct _PMD { unsigned char mdisp[4]; /* +0x0000 74 00 00 00 */ unsigned char pdisp[4]; /* +0x0004 74 00 00 00 */ unsigned char vdisp[4]; /* +0x0008 74 00 00 00 */ }; struct tagCAC { unsigned long cElems; /* +0x0000 */ char *pElems; /* +0x0004 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_4 { unsigned char arrayOfBaseClassDescriptors[5]; /* +0x0000 74 1b 00 00 */ }; struct _SECURITY_QUALITY_OF_SERVICE { unsigned long Length; /* +0x0000 */ unsigned char ImpersonationLevel[4]; /* +0x0004 de 15 00 00 */ unsigned char ContextTrackingMode; /* +0x0008 */ unsigned char EffectiveOnly; /* +0x0009 */ }; struct _WUDFMESSAGE_HEADER { unsigned char Message[1]; /* +0x0000 a2 16 00 00 */ }; struct tagCACLSID { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 69 12 00 00 */ }; struct _NT_TIB { unsigned char ExceptionList[4]; /* +0x0000 7f 1b 00 00 */ void *StackBase; /* +0x0004 */ void *StackLimit; /* +0x0008 */ void *SubSystemTib; /* +0x000c */ void *FiberData; /* +0x0010 */ unsigned long Version; /* +0x0010 */ void *ArbitraryUserPointer; /* +0x0014 */ unsigned char Self[4]; /* +0x0018 80 1b 00 00 */ }; struct _NT_TIB:: { void *FiberData; /* +0x0000 */ unsigned long Version; /* +0x0000 */ }; struct _WHEA_REVISION:: { unsigned char MinorRevision; /* +0x0000 */ unsigned char MajorRevision; /* +0x0001 */ }; struct $_TypeDescriptor$_extraBytes_22 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[22]; /* +0x0008 88 1b 00 00 */ }; struct tagCAUH { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 8c 1b 00 00 */ }; struct _DRIVER_EXTENSION { unsigned char DriverObject[4]; /* +0x0000 f4 11 00 00 */ unsigned char AddDevice[4]; /* +0x0004 90 1b 00 00 */ unsigned long Count; /* +0x0008 */ unsigned char ServiceKeyName[8]; /* +0x000c a0 10 00 00 */ }; struct _PRIVILEGE_SET { unsigned long PrivilegeCount; /* +0x0000 */ unsigned long Control; /* +0x0004 */ unsigned char Privilege[12]; /* +0x0008 94 1b 00 00 */ }; struct _TEB:: { /* unsigned char CurrentIdealProcessor[0]; +0x0000 a5 10 00 00 */ unsigned long IdealProcessorValue; /* +0x0000 */ unsigned char ReservedPad0; /* +0x0000 */ unsigned char ReservedPad1; /* +0x0001 */ unsigned char ReservedPad2; /* +0x0002 */ unsigned char IdealProcessor; /* +0x0003 */ }; struct _TEB:::: { unsigned char ReservedPad0; /* +0x0000 */ unsigned char ReservedPad1; /* +0x0001 */ unsigned char ReservedPad2; /* +0x0002 */ unsigned char IdealProcessor; /* +0x0003 */ }; struct _TEB:: { /* unsigned char CrossTebFlags[0]; +0x0000 a8 10 00 00 */ unsigned char SpareCrossTebBits[2]; /* +0x0000 a9 10 00 00 */ }; struct _TEB:::: { unsigned char SpareCrossTebBits[2]; /* +0x0000 a9 10 00 00 */ }; struct _TEB:: { unsigned short SameTebFlags; /* +0x0000 */ /* unsigned char SafeThunkCall[0]; +0x0000 aa 10 00 00 */ /* unsigned char InDebugPrint[0]; +0x0000 ab 10 00 00 */ /* unsigned char HasFiberData[0]; +0x0000 ac 10 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x0000 ad 10 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x0000 ae 10 00 00 */ /* unsigned char RanProcessInit[0]; +0x0000 af 10 00 00 */ /* unsigned char ClonedThread[0]; +0x0000 b0 10 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x0000 b1 10 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x0000 b2 10 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x0000 b3 10 00 00 */ /* unsigned char InitialThread[0]; +0x0000 b4 10 00 00 */ /* unsigned char SessionAware[0]; +0x0000 b5 10 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x0000 b6 10 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x0000 b7 10 00 00 */ }; struct _TEB:::: { /* unsigned char SafeThunkCall[0]; +0x0000 aa 10 00 00 */ /* unsigned char InDebugPrint[0]; +0x0000 ab 10 00 00 */ /* unsigned char HasFiberData[0]; +0x0000 ac 10 00 00 */ /* unsigned char SkipThreadAttach[0]; +0x0000 ad 10 00 00 */ /* unsigned char WerInShipAssertCode[0]; +0x0000 ae 10 00 00 */ /* unsigned char RanProcessInit[0]; +0x0000 af 10 00 00 */ /* unsigned char ClonedThread[0]; +0x0000 b0 10 00 00 */ /* unsigned char SuppressDebugMsg[0]; +0x0000 b1 10 00 00 */ /* unsigned char DisableUserStackWalk[0]; +0x0000 b2 10 00 00 */ /* unsigned char RtlExceptionAttached[0]; +0x0000 b3 10 00 00 */ /* unsigned char InitialThread[0]; +0x0000 b4 10 00 00 */ /* unsigned char SessionAware[0]; +0x0000 b5 10 00 00 */ /* unsigned char DisabledStackCheck[0]; +0x0000 b6 10 00 00 */ unsigned char SpareSameTebBits[2]; /* +0x0000 b7 10 00 00 */ }; struct _IMAGE_FILE_HEADER { unsigned short Machine; /* +0x0000 */ unsigned short NumberOfSections; /* +0x0002 */ unsigned long TimeDateStamp; /* +0x0004 */ unsigned long PointerToSymbolTable; /* +0x0008 */ unsigned long NumberOfSymbols; /* +0x000c */ unsigned short SizeOfOptionalHeader; /* +0x0010 */ unsigned short Characteristics; /* +0x0012 */ }; struct RdFdoDevice:: { /* unsigned char m_PnPCancelRemoveTracker[0]; +0x0000 c0 18 00 00 */ unsigned char m_PnPCancelStopTracker[4]; /* +0x0000 c0 18 00 00 */ }; enum _WDF_PROPERTY_STORE_RETRIEVE_FLAGS { WdfPropertyStoreNormal = 0, WdfPropertyStoreCreateIfMissing = 1, WdfPropertyStoreCreateVolatile = 2, WdfPropertyStoreRetrieveFlagsMask = 3 }; enum _USER_ACTIVITY_PRESENCE { PowerUserPresent = 0, PowerUserNotPresent = 1, PowerUserInactive = 2, PowerUserMaximum = 3, PowerUserInvalid = 3 }; struct tagCADBL { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 41 04 00 00 */ }; struct tagCACLIPDATA { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 fa 12 00 00 */ }; struct _GENERAL_LOOKASIDE:: { /* unsigned char ListHead[0]; +0x0000 57 11 00 00 */ unsigned char SingleListHead[8]; /* +0x0000 c8 10 00 00 */ }; struct _GENERAL_LOOKASIDE:: { unsigned long AllocateMisses; /* +0x0000 */ unsigned long AllocateHits; /* +0x0000 */ }; struct _GENERAL_LOOKASIDE:: { unsigned long FreeMisses; /* +0x0000 */ unsigned long FreeHits; /* +0x0000 */ }; struct _GENERAL_LOOKASIDE:: { /* unsigned char AllocateEx[0]; +0x0000 66 11 00 00 */ unsigned char Allocate[4]; /* +0x0000 69 11 00 00 */ }; struct _GENERAL_LOOKASIDE:: { /* unsigned char FreeEx[0]; +0x0000 6c 11 00 00 */ unsigned char Free[4]; /* +0x0000 6f 11 00 00 */ }; struct _GENERAL_LOOKASIDE:: { unsigned long LastAllocateMisses; /* +0x0000 */ unsigned long LastAllocateHits; /* +0x0000 */ }; enum tagCHANGEKIND { CHANGEKIND_ADDMEMBER = 0, CHANGEKIND_DELETEMEMBER = 1, CHANGEKIND_SETNAMES = 2, CHANGEKIND_SETDOCUMENTATION = 3, CHANGEKIND_GENERAL = 4, CHANGEKIND_INVALIDATE = 5, CHANGEKIND_CHANGEFAILED = 6, CHANGEKIND_MAX = 7 }; struct _IO_COMPLETION_CONTEXT { void *Port; /* +0x0000 */ void *Key; /* +0x0004 */ }; struct tagCABSTRBLOB { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 c0 1b 00 00 */ }; struct _KUSER_SHARED_DATA:: { unsigned char MitigationPolicies; /* +0x0000 */ /* unsigned char NXSupportPolicy[0]; +0x0000 35 10 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x0000 36 10 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x0000 37 10 00 00 */ unsigned char Reserved[1]; /* +0x0000 38 10 00 00 */ }; struct _KUSER_SHARED_DATA:::: { /* unsigned char NXSupportPolicy[0]; +0x0000 35 10 00 00 */ /* unsigned char SEHValidationPolicy[0]; +0x0000 36 10 00 00 */ /* unsigned char CurDirDevicesSkippedForDlls[0]; +0x0000 37 10 00 00 */ unsigned char Reserved[1]; /* +0x0000 38 10 00 00 */ }; struct _KUSER_SHARED_DATA:: { unsigned long SharedDataFlags; /* +0x0000 */ /* unsigned char DbgErrorPortPresent[0]; +0x0000 3b 10 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x0000 3c 10 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x0000 3d 10 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x0000 3e 10 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x0000 3f 10 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x0000 40 10 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x0000 41 10 00 00 */ unsigned char SpareBits[4]; /* +0x0000 42 10 00 00 */ }; struct _KUSER_SHARED_DATA:::: { /* unsigned char DbgErrorPortPresent[0]; +0x0000 3b 10 00 00 */ /* unsigned char DbgElevationEnabled[0]; +0x0000 3c 10 00 00 */ /* unsigned char DbgVirtEnabled[0]; +0x0000 3d 10 00 00 */ /* unsigned char DbgInstallerDetectEnabled[0]; +0x0000 3e 10 00 00 */ /* unsigned char DbgLkgEnabled[0]; +0x0000 3f 10 00 00 */ /* unsigned char DbgDynProcessorEnabled[0]; +0x0000 40 10 00 00 */ /* unsigned char DbgConsoleBrokerEnabled[0]; +0x0000 41 10 00 00 */ unsigned char SpareBits[4]; /* +0x0000 42 10 00 00 */ }; struct _KUSER_SHARED_DATA:: { /* unsigned char TickCount[0]; +0x0000 23 10 00 00 */ /* unsigned char TickCountQuad[0]; +0x0000 44 10 00 00 */ unsigned char ReservedTickCountOverlay[12]; /* +0x0000 45 10 00 00 */ unsigned char TickCountPad[4]; /* +0x000c 33 10 00 00 */ }; struct _KUSER_SHARED_DATA:::: { unsigned char ReservedTickCountOverlay[12]; /* +0x0000 45 10 00 00 */ unsigned char TickCountPad[4]; /* +0x000c 33 10 00 00 */ }; struct _KUSER_SHARED_DATA:: { unsigned short TscQpcData; /* +0x0000 */ unsigned char TscQpcEnabled[1]; /* +0x0000 48 10 00 00 */ unsigned char TscQpcShift; /* +0x0001 */ }; struct _KUSER_SHARED_DATA:::: { unsigned char TscQpcEnabled[1]; /* +0x0000 48 10 00 00 */ unsigned char TscQpcShift; /* +0x0001 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_64 { unsigned char arrayOfBaseClassDescriptors[65]; /* +0x0000 d4 1b 00 00 */ }; struct _IO_REMOVE_LOCK { unsigned char Common[24]; /* +0x0000 d7 1b 00 00 */ }; struct _s__RTTIBaseClassArray { unsigned char arrayOfBaseClassDescriptors[1]; /* +0x0000 da 1b 00 00 */ }; struct tagCAPROPVARIANT { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 f6 12 00 00 */ }; struct _KSPIN_LOCK_QUEUE { unsigned char Next[4]; /* +0x0000 e0 1b 00 00 */ unsigned char Lock[4]; /* +0x0004 e1 1b 00 00 */ }; struct _IO_OBJECT { /* unsigned char DeviceObject[0]; +0x0000 ca 11 00 00 */ unsigned char DriverObject[4]; /* +0x0000 f4 11 00 00 */ }; enum tagShutdownType { IdleShutdown = 0, ForcedShutdown = 1 }; enum tagDOMNodeType { NODE_INVALID = 0, NODE_ELEMENT = 1, NODE_ATTRIBUTE = 2, NODE_TEXT = 3, NODE_CDATA_SECTION = 4, NODE_ENTITY_REFERENCE = 5, NODE_ENTITY = 6, NODE_PROCESSING_INSTRUCTION = 7, NODE_COMMENT = 8, NODE_DOCUMENT = 9, NODE_DOCUMENT_TYPE = 10, NODE_DOCUMENT_FRAGMENT = 11, NODE_NOTATION = 12 }; struct _DEVPROPKEY { unsigned char fmtid[16]; /* +0x0000 13 10 00 00 */ unsigned long pid; /* +0x0010 */ }; struct tagVARIANT { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ long long llVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 f7 12 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0008 fe 12 00 00 */ /* unsigned char pdispVal[0]; +0x0008 00 13 00 00 */ /* unsigned char parray[0]; +0x0008 08 13 00 00 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ long *plVal; /* +0x0008 */ long long *pllVal; /* +0x0008 */ /* unsigned char pfltVal[0]; +0x0008 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 04 00 00 */ short *pboolVal; /* +0x0008 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 21 13 00 00 */ /* unsigned char pdate[0]; +0x0008 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e6 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 22 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 23 13 00 00 */ /* unsigned char pparray[0]; +0x0008 24 13 00 00 */ /* unsigned char pvarVal[0]; +0x0008 04 1c 00 00 */ void *byref; /* +0x0008 */ char cVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ unsigned long long ullVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char pdecVal[0]; +0x0008 20 13 00 00 */ char *pcVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ unsigned long long *pullVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 04 00 00 */ void *pvRecord; /* +0x0008 */ /* unsigned char pRecInfo[-12]; +0x000c 16 1c 00 00 */ unsigned char decVal[16]; /* +0x0000 1f 13 00 00 */ }; enum tagBINDSTATUS { BINDSTATUS_FINDINGRESOURCE = 1, BINDSTATUS_CONNECTING = 2, BINDSTATUS_REDIRECTING = 3, BINDSTATUS_BEGINDOWNLOADDATA = 4, BINDSTATUS_DOWNLOADINGDATA = 5, BINDSTATUS_ENDDOWNLOADDATA = 6, BINDSTATUS_BEGINDOWNLOADCOMPONENTS = 7, BINDSTATUS_INSTALLINGCOMPONENTS = 8, BINDSTATUS_ENDDOWNLOADCOMPONENTS = 9, BINDSTATUS_USINGCACHEDCOPY = 10, BINDSTATUS_SENDINGREQUEST = 11, BINDSTATUS_CLASSIDAVAILABLE = 12, BINDSTATUS_MIMETYPEAVAILABLE = 13, BINDSTATUS_CACHEFILENAMEAVAILABLE = 14, BINDSTATUS_BEGINSYNCOPERATION = 15, BINDSTATUS_ENDSYNCOPERATION = 16, BINDSTATUS_BEGINUPLOADDATA = 17, BINDSTATUS_UPLOADINGDATA = 18, BINDSTATUS_ENDUPLOADDATA = 19, BINDSTATUS_PROTOCOLCLASSID = 20, BINDSTATUS_ENCODING = 21, BINDSTATUS_VERIFIEDMIMETYPEAVAILABLE = 22, BINDSTATUS_CLASSINSTALLLOCATION = 23, BINDSTATUS_DECODING = 24, BINDSTATUS_LOADINGMIMEHANDLER = 25, BINDSTATUS_CONTENTDISPOSITIONATTACH = 26, BINDSTATUS_FILTERREPORTMIMETYPE = 27, BINDSTATUS_CLSIDCANINSTANTIATE = 28, BINDSTATUS_IUNKNOWNAVAILABLE = 29, BINDSTATUS_DIRECTBIND = 30, BINDSTATUS_RAWMIMETYPE = 31, BINDSTATUS_PROXYDETECTING = 32, BINDSTATUS_ACCEPTRANGES = 33, BINDSTATUS_COOKIE_SENT = 34, BINDSTATUS_COMPACT_POLICY_RECEIVED = 35, BINDSTATUS_COOKIE_SUPPRESSED = 36, BINDSTATUS_COOKIE_STATE_UNKNOWN = 37, BINDSTATUS_COOKIE_STATE_ACCEPT = 38, BINDSTATUS_COOKIE_STATE_REJECT = 39, BINDSTATUS_COOKIE_STATE_PROMPT = 40, BINDSTATUS_COOKIE_STATE_LEASH = 41, BINDSTATUS_COOKIE_STATE_DOWNGRADE = 42, BINDSTATUS_POLICY_HREF = 43, BINDSTATUS_P3P_HEADER = 44, BINDSTATUS_SESSION_COOKIE_RECEIVED = 45, BINDSTATUS_PERSISTENT_COOKIE_RECEIVED = 46, BINDSTATUS_SESSION_COOKIES_ALLOWED = 47, BINDSTATUS_CACHECONTROL = 48, BINDSTATUS_CONTENTDISPOSITIONFILENAME = 49, BINDSTATUS_MIMETEXTPLAINMISMATCH = 50, BINDSTATUS_PUBLISHERAVAILABLE = 51, BINDSTATUS_DISPLAYNAMEAVAILABLE = 52, BINDSTATUS_SSLUX_NAVBLOCKED = 53, BINDSTATUS_SERVER_MIMETYPEAVAILABLE = 54, BINDSTATUS_SNIFFED_CLASSIDAVAILABLE = 55, BINDSTATUS_64BIT_PROGRESS = 56, BINDSTATUS_LAST = 56, BINDSTATUS_RESERVED_0 = 57, BINDSTATUS_RESERVED_1 = 58, BINDSTATUS_RESERVED_2 = 59, BINDSTATUS_RESERVED_3 = 60, BINDSTATUS_RESERVED_4 = 61, BINDSTATUS_RESERVED_5 = 62, BINDSTATUS_RESERVED_6 = 63, BINDSTATUS_RESERVED_7 = 64, BINDSTATUS_RESERVED_8 = 65, BINDSTATUS_RESERVED_9 = 66, BINDSTATUS_LAST_PRIVATE = 66 }; struct _TARGET_DEVICE_CUSTOM_NOTIFICATION { unsigned short Version; /* +0x0000 */ unsigned short Size; /* +0x0002 */ unsigned char Event[16]; /* +0x0004 13 10 00 00 */ unsigned char FileObject[4]; /* +0x0014 e0 11 00 00 */ long NameBufferOffset; /* +0x0018 */ unsigned char CustomDataBuffer[4]; /* +0x001c 2f 10 00 00 */ }; struct _PEB { unsigned char InheritedAddressSpace; /* +0x0000 */ unsigned char ReadImageFileExecOptions; /* +0x0001 */ unsigned char BeingDebugged; /* +0x0002 */ unsigned char BitField; /* +0x0003 */ /* unsigned char ImageUsesLargePages[0]; +0x0003 06 11 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0003 1d 1b 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0003 1e 1b 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0003 1f 1b 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0003 24 1c 00 00 */ unsigned char SpareBits[1]; /* +0x0003 25 1c 00 00 */ void *Mutant; /* +0x0004 */ void *ImageBaseAddress; /* +0x0008 */ unsigned char Ldr[4]; /* +0x000c 27 1c 00 00 */ unsigned char ProcessParameters[4]; /* +0x0010 29 1c 00 00 */ void *SubSystemData; /* +0x0014 */ void *ProcessHeap; /* +0x0018 */ unsigned char FastPebLock[4]; /* +0x001c 2b 1c 00 00 */ void *AtlThunkSListPtr; /* +0x0020 */ void *IFEOKey; /* +0x0024 */ unsigned long CrossProcessFlags; /* +0x0028 */ /* unsigned char ProcessInJob[0]; +0x0028 3b 10 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0028 3c 10 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0028 3d 10 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0028 3e 10 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0028 3f 10 00 00 */ unsigned char ReservedBits0[4]; /* +0x0028 2c 1c 00 00 */ void *KernelCallbackTable; /* +0x002c */ void *UserSharedInfoPtr; /* +0x002c */ unsigned char SystemReserved[4]; /* +0x0030 33 10 00 00 */ unsigned long AtlThunkSListPtr32; /* +0x0034 */ void *ApiSetMap; /* +0x0038 */ unsigned long TlsExpansionCounter; /* +0x003c */ void *TlsBitmap; /* +0x0040 */ unsigned char TlsBitmapBits[8]; /* +0x0044 2c 10 00 00 */ void *ReadOnlySharedMemoryBase; /* +0x004c */ void *HotpatchInformation; /* +0x0050 */ unsigned char ReadOnlyStaticServerData[4]; /* +0x0054 21 10 00 00 */ void *AnsiCodePageData; /* +0x0058 */ void *OemCodePageData; /* +0x005c */ void *UnicodeCaseTableData; /* +0x0060 */ unsigned long NumberOfProcessors; /* +0x0064 */ unsigned long NtGlobalFlag; /* +0x0068 */ unsigned char CriticalSectionTimeout[8]; /* +0x0070 34 10 00 00 */ unsigned long HeapSegmentReserve; /* +0x0078 */ unsigned long HeapSegmentCommit; /* +0x007c */ unsigned long HeapDeCommitTotalFreeThreshold; /* +0x0080 */ unsigned long HeapDeCommitFreeBlockThreshold; /* +0x0084 */ unsigned long NumberOfHeaps; /* +0x0088 */ unsigned long MaximumNumberOfHeaps; /* +0x008c */ unsigned char ProcessHeaps[4]; /* +0x0090 21 10 00 00 */ void *GdiSharedHandleTable; /* +0x0094 */ void *ProcessStarterHelper; /* +0x0098 */ unsigned long GdiDCAttributeList; /* +0x009c */ unsigned char LoaderLock[4]; /* +0x00a0 2b 1c 00 00 */ unsigned long OSMajorVersion; /* +0x00a4 */ unsigned long OSMinorVersion; /* +0x00a8 */ unsigned short OSBuildNumber; /* +0x00ac */ unsigned short OSCSDVersion; /* +0x00ae */ unsigned long OSPlatformId; /* +0x00b0 */ unsigned long ImageSubsystem; /* +0x00b4 */ unsigned long ImageSubsystemMajorVersion; /* +0x00b8 */ unsigned long ImageSubsystemMinorVersion; /* +0x00bc */ unsigned long ActiveProcessAffinityMask; /* +0x00c0 */ unsigned char GdiHandleBuffer[136]; /* +0x00c4 2d 1c 00 00 */ unsigned char PostProcessInitRoutine[4]; /* +0x014c 2e 1c 00 00 */ void *TlsExpansionBitmap; /* +0x0150 */ unsigned char TlsExpansionBitmapBits[128]; /* +0x0154 61 1b 00 00 */ unsigned long SessionId; /* +0x01d4 */ unsigned char AppCompatFlags[8]; /* +0x01d8 4c 10 00 00 */ unsigned char AppCompatFlagsUser[8]; /* +0x01e0 4c 10 00 00 */ void *pShimData; /* +0x01e8 */ void *AppCompatInfo; /* +0x01ec */ unsigned char CSDVersion[8]; /* +0x01f0 a0 10 00 00 */ unsigned char ActivationContextData[4]; /* +0x01f8 31 1c 00 00 */ unsigned char ProcessAssemblyStorageMap[4]; /* +0x01fc 33 1c 00 00 */ unsigned char SystemDefaultActivationContextData[4]; /* +0x0200 31 1c 00 00 */ unsigned char SystemAssemblyStorageMap[4]; /* +0x0204 33 1c 00 00 */ unsigned long MinimumStackCommit; /* +0x0208 */ unsigned char FlsCallback[4]; /* +0x020c 35 1c 00 00 */ unsigned char FlsListHead[8]; /* +0x0210 80 10 00 00 */ void *FlsBitmap; /* +0x0218 */ unsigned char FlsBitmapBits[16]; /* +0x021c 36 1c 00 00 */ unsigned long FlsHighIndex; /* +0x022c */ void *WerRegistrationData; /* +0x0230 */ void *WerShipAssertPtr; /* +0x0234 */ void *pUnused; /* +0x0238 */ void *pImageHeaderHash; /* +0x023c */ unsigned long TracingFlags; /* +0x0240 */ /* unsigned char HeapTracingEnabled[0]; +0x0240 3b 10 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0240 3c 10 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0240 3d 10 00 00 */ unsigned char SpareTracingBits[8]; /* +0x0240 37 1c 00 00 */ unsigned long long CsrServerReadOnlySharedMemoryBase; /* +0x0248 */ }; enum _JOBOBJECTINFOCLASS { JobObjectBasicAccountingInformation = 1, JobObjectBasicLimitInformation = 2, JobObjectBasicProcessIdList = 3, JobObjectBasicUIRestrictions = 4, JobObjectSecurityLimitInformation = 5, JobObjectEndOfJobTimeInformation = 6, JobObjectAssociateCompletionPortInformation = 7, JobObjectBasicAndIoAccountingInformation = 8, JobObjectExtendedLimitInformation = 9, JobObjectJobSetInformation = 10, JobObjectGroupInformation = 11, JobObjectNotificationLimitInformation = 12, JobObjectLimitViolationInformation = 13, JobObjectGroupInformationEx = 14, JobObjectCpuRateControlInformation = 15, JobObjectCompletionFilter = 16, JobObjectCompletionCounter = 17, JobObjectFreezeInformation = 18, JobObjectExtendedAccountingInformation = 19, JobObjectWakeInformation = 20, JobObjectIdleAwareInformation = 21, JobObjectSchedulingRankBiasInformation = 22, JobObjectTimerVirtualizationInformation = 23, JobObjectCycleTimeNotification = 24, JobObjectReserved1Information = 18, JobObjectReserved2Information = 19, JobObjectReserved3Information = 20, JobObjectReserved4Information = 21, JobObjectReserved5Information = 22, JobObjectReserved6Information = 23, JobObjectReserved7Information = 24, MaxJobObjectInfoClass = 25 }; struct tagCAFLT { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 40 04 00 00 */ }; struct _FILETIME { unsigned long dwLowDateTime; /* +0x0000 */ unsigned long dwHighDateTime; /* +0x0004 */ }; struct $_TypeDescriptor$_extraBytes_16 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[16]; /* +0x0008 41 1c 00 00 */ }; struct _TEB_ACTIVE_FRAME_CONTEXT { unsigned long Flags; /* +0x0000 */ unsigned char FrameName[4]; /* +0x0004 0c 10 00 00 */ }; struct _RdIrpTailContext:: { /* unsigned char MappedAddress[0]; +0x0000 a3 10 00 00 */ unsigned char RundownListEntry[8]; /* +0x0000 9d 18 00 00 */ unsigned char SafeMdl[8]; /* +0x0008 46 1c 00 00 */ }; struct _RdIrpTailContext:::: { /* unsigned char MappedAddress[0]; +0x0000 a3 10 00 00 */ unsigned char RundownListEntry[8]; /* +0x0000 9d 18 00 00 */ }; struct _XSTATE_CONFIGURATION { unsigned long long EnabledFeatures; /* +0x0000 */ unsigned long Size; /* +0x0008 */ unsigned char OptimizedSave[4]; /* +0x000c 3b 10 00 00 */ unsigned char Features[512]; /* +0x0010 4c 1c 00 00 */ }; struct $_TypeDescriptor$_extraBytes_63 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[63]; /* +0x0008 50 1c 00 00 */ }; struct tagCAH { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 33 1a 00 00 */ }; struct tagVersionedStream { unsigned char guidVersion[16]; /* +0x0000 13 10 00 00 */ unsigned char pStream[4]; /* +0x0010 02 13 00 00 */ }; struct $_TypeDescriptor$_extraBytes_19 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[19]; /* +0x0008 58 1c 00 00 */ }; struct _IO_RESOURCE_DESCRIPTOR { unsigned char Option; /* +0x0000 */ unsigned char Type; /* +0x0001 */ unsigned char ShareDisposition; /* +0x0002 */ unsigned char Spare1; /* +0x0003 */ unsigned short Flags; /* +0x0004 */ unsigned short Spare2; /* +0x0006 */ }; struct _CM_FULL_RESOURCE_DESCRIPTOR { unsigned char InterfaceType[4]; /* +0x0000 e8 1a 00 00 */ unsigned long BusNumber; /* +0x0004 */ unsigned char PartialResourceList[24]; /* +0x0008 5e 1c 00 00 */ }; struct _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS { /* unsigned char Primary[0]; +0x0000 3b 10 00 00 */ /* unsigned char ContainmentWarning[0]; +0x0000 3c 10 00 00 */ /* unsigned char Reset[0]; +0x0000 3d 10 00 00 */ /* unsigned char ThresholdExceeded[0]; +0x0000 3e 10 00 00 */ /* unsigned char ResourceNotAvailable[0]; +0x0000 3f 10 00 00 */ /* unsigned char LatentError[0]; +0x0000 40 10 00 00 */ /* unsigned char Reserved[0]; +0x0000 6a 1b 00 00 */ unsigned long AsULONG; /* +0x0000 */ }; struct _RD_PNP_ROUTING_RULES { unsigned char m_PreProcessingCallback[16]; /* +0x0000 63 1c 00 00 */ unsigned char m_PostProcessingCallback[16]; /* +0x0010 63 1c 00 00 */ unsigned char m_PreCompletionCallback[16]; /* +0x0020 63 1c 00 00 */ unsigned char m_PostCompletionCallback[16]; /* +0x0030 63 1c 00 00 */ unsigned char m_HostCannotFail; /* +0x0040 */ unsigned char m_Forward; /* +0x0041 */ unsigned char m_Synchronous; /* +0x0042 */ unsigned char m_HostMustProcessIrp; /* +0x0043 */ unsigned char m_HostMustForwardIrpOnSuccess; /* +0x0044 */ unsigned char m_IgnoreFailure; /* +0x0045 */ unsigned char m_IgnoreHostProblem; /* +0x0046 */ unsigned char m_IsStateChanging; /* +0x0047 */ }; struct _WUDFMESSAGE_IO_HEADER { unsigned char Header[4]; /* +0x0000 5e 13 00 00 */ void *Irp; /* +0x0004 */ unsigned long long RequestId; /* +0x0008 */ unsigned long ProcessId; /* +0x0010 */ unsigned char Is32bitProcess; /* +0x0014 */ char RequestorMode; /* +0x0015 */ unsigned char DirectMappedTransfer; /* +0x0016 */ }; struct WMIREGGUIDW:: { unsigned long InstanceNameList; /* +0x0000 */ unsigned long BaseNameOffset; /* +0x0000 */ unsigned long Pdo; /* +0x0000 */ unsigned long InstanceInfo; /* +0x0000 */ }; enum CPU_VENDORS { CPU_NONE = 0, CPU_INTEL = 1, CPU_AMD = 2, CPU_CYRIX = 3, CPU_TRANSMETA = 4, CPU_VIA = 5, CPU_CENTAUR = 5, CPU_RISE = 6, CPU_UNKNOWN = 7 }; struct tagPROPVARIANT:::: { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ char cVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char hVal[0]; +0x0008 34 10 00 00 */ /* unsigned char uhVal[0]; +0x0008 4c 10 00 00 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 f7 12 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char filetime[0]; +0x0008 f8 12 00 00 */ /* unsigned char puuid[0]; +0x0008 69 12 00 00 */ /* unsigned char pclipdata[0]; +0x0008 fa 12 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 04 00 00 */ /* unsigned char bstrblobVal[0]; +0x0008 fb 12 00 00 */ /* unsigned char blob[0]; +0x0008 fc 12 00 00 */ char *pszVal; /* +0x0008 */ /* unsigned char pwszVal[0]; +0x0008 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0008 fe 12 00 00 */ /* unsigned char pdispVal[0]; +0x0008 00 13 00 00 */ /* unsigned char pStream[0]; +0x0008 02 13 00 00 */ /* unsigned char pStorage[0]; +0x0008 04 13 00 00 */ /* unsigned char pVersionedStream[0]; +0x0008 06 13 00 00 */ /* unsigned char parray[0]; +0x0008 08 13 00 00 */ /* unsigned char cac[0]; +0x0008 09 13 00 00 */ /* unsigned char caub[0]; +0x0008 0a 13 00 00 */ /* unsigned char cai[0]; +0x0008 0b 13 00 00 */ /* unsigned char caui[0]; +0x0008 0c 13 00 00 */ /* unsigned char cal[0]; +0x0008 0d 13 00 00 */ /* unsigned char caul[0]; +0x0008 0e 13 00 00 */ /* unsigned char cah[0]; +0x0008 0f 13 00 00 */ /* unsigned char cauh[0]; +0x0008 10 13 00 00 */ /* unsigned char caflt[0]; +0x0008 11 13 00 00 */ /* unsigned char cadbl[0]; +0x0008 12 13 00 00 */ /* unsigned char cabool[0]; +0x0008 13 13 00 00 */ /* unsigned char cascode[0]; +0x0008 14 13 00 00 */ /* unsigned char cacy[0]; +0x0008 15 13 00 00 */ /* unsigned char cadate[0]; +0x0008 16 13 00 00 */ /* unsigned char cafiletime[0]; +0x0008 17 13 00 00 */ /* unsigned char cauuid[0]; +0x0008 18 13 00 00 */ /* unsigned char caclipdata[0]; +0x0008 19 13 00 00 */ /* unsigned char cabstr[0]; +0x0008 1a 13 00 00 */ /* unsigned char cabstrblob[0]; +0x0008 1b 13 00 00 */ /* unsigned char calpstr[0]; +0x0008 1c 13 00 00 */ /* unsigned char calpwstr[0]; +0x0008 1d 13 00 00 */ /* unsigned char capropvar[0]; +0x0008 1e 13 00 00 */ char *pcVal; /* +0x0008 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ long *plVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 04 00 00 */ /* unsigned char pfltVal[0]; +0x0008 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 04 00 00 */ short *pboolVal; /* +0x0008 */ /* unsigned char pdecVal[0]; +0x0008 20 13 00 00 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 21 13 00 00 */ /* unsigned char pdate[0]; +0x0008 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e6 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 22 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 23 13 00 00 */ /* unsigned char pparray[0]; +0x0008 24 13 00 00 */ unsigned char pvarVal[8]; /* +0x0008 f6 12 00 00 */ }; struct tagPROPVARIANT:::::: { char cVal; /* +0x0000 */ unsigned char bVal; /* +0x0000 */ short iVal; /* +0x0000 */ unsigned short uiVal; /* +0x0000 */ long lVal; /* +0x0000 */ unsigned long ulVal; /* +0x0000 */ /* unsigned char intVal[0]; +0x0000 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0000 75 00 00 00 */ /* unsigned char hVal[0]; +0x0000 34 10 00 00 */ /* unsigned char uhVal[0]; +0x0000 4c 10 00 00 */ /* unsigned char fltVal[0]; +0x0000 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0000 41 00 00 00 */ short boolVal; /* +0x0000 */ long scode; /* +0x0000 */ /* unsigned char cyVal[0]; +0x0000 f7 12 00 00 */ /* unsigned char date[0]; +0x0000 41 00 00 00 */ /* unsigned char filetime[0]; +0x0000 f8 12 00 00 */ /* unsigned char puuid[0]; +0x0000 69 12 00 00 */ /* unsigned char pclipdata[0]; +0x0000 fa 12 00 00 */ /* unsigned char bstrVal[0]; +0x0000 71 04 00 00 */ /* unsigned char bstrblobVal[0]; +0x0000 fb 12 00 00 */ /* unsigned char blob[0]; +0x0000 fc 12 00 00 */ char *pszVal; /* +0x0000 */ /* unsigned char pwszVal[0]; +0x0000 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0000 fe 12 00 00 */ /* unsigned char pdispVal[0]; +0x0000 00 13 00 00 */ /* unsigned char pStream[0]; +0x0000 02 13 00 00 */ /* unsigned char pStorage[0]; +0x0000 04 13 00 00 */ /* unsigned char pVersionedStream[0]; +0x0000 06 13 00 00 */ /* unsigned char parray[0]; +0x0000 08 13 00 00 */ /* unsigned char cac[0]; +0x0000 09 13 00 00 */ /* unsigned char caub[0]; +0x0000 0a 13 00 00 */ /* unsigned char cai[0]; +0x0000 0b 13 00 00 */ /* unsigned char caui[0]; +0x0000 0c 13 00 00 */ /* unsigned char cal[0]; +0x0000 0d 13 00 00 */ /* unsigned char caul[0]; +0x0000 0e 13 00 00 */ /* unsigned char cah[0]; +0x0000 0f 13 00 00 */ /* unsigned char cauh[0]; +0x0000 10 13 00 00 */ /* unsigned char caflt[0]; +0x0000 11 13 00 00 */ /* unsigned char cadbl[0]; +0x0000 12 13 00 00 */ /* unsigned char cabool[0]; +0x0000 13 13 00 00 */ /* unsigned char cascode[0]; +0x0000 14 13 00 00 */ /* unsigned char cacy[0]; +0x0000 15 13 00 00 */ /* unsigned char cadate[0]; +0x0000 16 13 00 00 */ /* unsigned char cafiletime[0]; +0x0000 17 13 00 00 */ /* unsigned char cauuid[0]; +0x0000 18 13 00 00 */ /* unsigned char caclipdata[0]; +0x0000 19 13 00 00 */ /* unsigned char cabstr[0]; +0x0000 1a 13 00 00 */ /* unsigned char cabstrblob[0]; +0x0000 1b 13 00 00 */ /* unsigned char calpstr[0]; +0x0000 1c 13 00 00 */ /* unsigned char calpwstr[0]; +0x0000 1d 13 00 00 */ /* unsigned char capropvar[0]; +0x0000 1e 13 00 00 */ char *pcVal; /* +0x0000 */ unsigned char *pbVal; /* +0x0000 */ short *piVal; /* +0x0000 */ unsigned short *puiVal; /* +0x0000 */ long *plVal; /* +0x0000 */ unsigned long *pulVal; /* +0x0000 */ /* unsigned char pintVal[0]; +0x0000 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0000 75 04 00 00 */ /* unsigned char pfltVal[0]; +0x0000 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0000 41 04 00 00 */ short *pboolVal; /* +0x0000 */ /* unsigned char pdecVal[0]; +0x0000 20 13 00 00 */ long *pscode; /* +0x0000 */ /* unsigned char pcyVal[0]; +0x0000 21 13 00 00 */ /* unsigned char pdate[0]; +0x0000 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0000 e6 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0000 22 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0000 23 13 00 00 */ /* unsigned char pparray[0]; +0x0000 24 13 00 00 */ unsigned char pvarVal[8]; /* +0x0000 f6 12 00 00 */ }; struct tagLC_ID { unsigned short wLanguage; /* +0x0000 */ unsigned short wCountry; /* +0x0002 */ unsigned short wCodePage; /* +0x0004 */ }; struct $_TypeDescriptor$_extraBytes_93 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[93]; /* +0x0008 74 1c 00 00 */ }; struct _SLIST_HEADER:: { unsigned char Next[4]; /* +0x0000 c8 10 00 00 */ unsigned short Depth; /* +0x0004 */ unsigned short Sequence; /* +0x0006 */ }; struct _GDI_TEB_BATCH { unsigned long Offset; /* +0x0000 */ unsigned long HDC; /* +0x0004 */ unsigned char Buffer[1240]; /* +0x0008 ad 1c 00 00 */ }; enum tagINVOKEKIND { INVOKE_FUNC = 1, INVOKE_PROPERTYGET = 2, INVOKE_PROPERTYPUT = 4, INVOKE_PROPERTYPUTREF = 8 }; struct _GENERIC_MAPPING { unsigned long GenericRead; /* +0x0000 */ unsigned long GenericWrite; /* +0x0004 */ unsigned long GenericExecute; /* +0x0008 */ unsigned long GenericAll; /* +0x000c */ }; struct tagCALPSTR { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 eb 10 00 00 */ }; struct _TypeDescriptor { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ /* unsigned char name[0]; +0x0008 f7 1c 00 00 */ }; enum WudfBreakPointType { WudfPlatformUserBreakin = 1, WudfPlatformKernelBreakin = 2, WudfPlatformUserOrKernelBreakin = 3 }; struct _USB_IDLE_CALLBACK_INFO { unsigned char IdleCallback[4]; /* +0x0000 6f 11 00 00 */ void *IdleContext; /* +0x0004 */ }; struct _XSTATE_FEATURE { unsigned long Offset; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct tagCACY { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 21 13 00 00 */ }; struct _KDEVICE_QUEUE_ENTRY { unsigned char DeviceListEntry[8]; /* +0x0000 80 10 00 00 */ unsigned long SortKey; /* +0x0008 */ unsigned char Inserted; /* +0x000c */ }; struct _IO_STATUS_BLOCK:: { long Status; /* +0x0000 */ void *Pointer; /* +0x0000 */ }; struct _WHEA_ERROR_PACKET_FLAGS:: { /* unsigned char PreviousError[0]; +0x0000 3b 10 00 00 */ /* unsigned char Reserved1[0]; +0x0000 3c 10 00 00 */ /* unsigned char HypervisorError[0]; +0x0000 3d 10 00 00 */ /* unsigned char Simulated[0]; +0x0000 3e 10 00 00 */ /* unsigned char PlatformPfaControl[0]; +0x0000 3f 10 00 00 */ /* unsigned char PlatformDirectedOffline[0]; +0x0000 40 10 00 00 */ unsigned char Reserved2[4]; /* +0x0000 6a 1b 00 00 */ }; struct _IO_RESOURCE_DESCRIPTOR:::: { unsigned long Length; /* +0x0000 */ unsigned long Alignment; /* +0x0004 */ unsigned char MinimumAddress[8]; /* +0x0008 34 10 00 00 */ unsigned char MaximumAddress[8]; /* +0x0010 34 10 00 00 */ }; enum _IRQ_PRIORITY { IrqPriorityUndefined = 0, IrqPriorityLow = 1, IrqPriorityNormal = 2, IrqPriorityHigh = 3 }; struct _IO_RESOURCE_DESCRIPTOR:::: { unsigned long MinimumVector; /* +0x0000 */ unsigned long MaximumVector; /* +0x0004 */ unsigned short AffinityPolicy; /* +0x0008 */ unsigned short Group; /* +0x000a */ unsigned char PriorityPolicy[4]; /* +0x000c 1c 1d 00 00 */ unsigned long TargetedProcessors; /* +0x0010 */ }; struct _IO_RESOURCE_DESCRIPTOR:::: { unsigned long MinimumChannel; /* +0x0000 */ unsigned long MaximumChannel; /* +0x0004 */ }; struct _IO_RESOURCE_DESCRIPTOR:::: { unsigned long RequestLine; /* +0x0000 */ unsigned long Reserved; /* +0x0004 */ unsigned long Channel; /* +0x0008 */ unsigned long TransferWidth; /* +0x000c */ }; struct _IO_RESOURCE_DESCRIPTOR:::: { unsigned char Data[12]; /* +0x0000 45 10 00 00 */ }; struct _IO_RESOURCE_DESCRIPTOR:::: { unsigned long Length; /* +0x0000 */ unsigned long MinBusNumber; /* +0x0004 */ unsigned long MaxBusNumber; /* +0x0008 */ unsigned long Reserved; /* +0x000c */ }; struct _IO_RESOURCE_DESCRIPTOR:::: { unsigned long Priority; /* +0x0000 */ unsigned long Reserved1; /* +0x0004 */ unsigned long Reserved2; /* +0x0008 */ }; struct _IO_RESOURCE_DESCRIPTOR:::: { unsigned long Length40; /* +0x0000 */ unsigned long Alignment40; /* +0x0004 */ unsigned char MinimumAddress[8]; /* +0x0008 34 10 00 00 */ unsigned char MaximumAddress[8]; /* +0x0010 34 10 00 00 */ }; struct _IO_RESOURCE_DESCRIPTOR:::: { unsigned long Length48; /* +0x0000 */ unsigned long Alignment48; /* +0x0004 */ unsigned char MinimumAddress[8]; /* +0x0008 34 10 00 00 */ unsigned char MaximumAddress[8]; /* +0x0010 34 10 00 00 */ }; struct _IO_RESOURCE_DESCRIPTOR:::: { unsigned long Length64; /* +0x0000 */ unsigned long Alignment64; /* +0x0004 */ unsigned char MinimumAddress[8]; /* +0x0008 34 10 00 00 */ unsigned char MaximumAddress[8]; /* +0x0010 34 10 00 00 */ }; struct _IO_RESOURCE_DESCRIPTOR:::: { unsigned char Class; /* +0x0000 */ unsigned char Type; /* +0x0001 */ unsigned char Reserved1; /* +0x0002 */ unsigned char Reserved2; /* +0x0003 */ unsigned long IdLowPart; /* +0x0004 */ unsigned long IdHighPart; /* +0x0008 */ }; struct _WHEA_ERROR_RECORD_HEADER_VALIDBITS { /* unsigned char PlatformId[0]; +0x0000 3b 10 00 00 */ /* unsigned char Timestamp[0]; +0x0000 3c 10 00 00 */ /* unsigned char PartitionId[0]; +0x0000 3d 10 00 00 */ /* unsigned char Reserved[0]; +0x0000 37 1c 00 00 */ unsigned long AsULONG; /* +0x0000 */ }; struct _WHEA_ERROR_RECORD_HEADER_VALIDBITS:: { /* unsigned char PlatformId[0]; +0x0000 3b 10 00 00 */ /* unsigned char Timestamp[0]; +0x0000 3c 10 00 00 */ /* unsigned char PartitionId[0]; +0x0000 3d 10 00 00 */ unsigned char Reserved[4]; /* +0x0000 37 1c 00 00 */ }; struct tagCAUI { unsigned long cElems; /* +0x0000 */ unsigned short *pElems; /* +0x0004 */ }; struct _CM_PARTIAL_RESOURCE_LIST { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned long Count; /* +0x0004 */ unsigned char PartialDescriptors[16]; /* +0x0008 62 1d 00 00 */ }; struct _SECTION_OBJECT_POINTERS { void *DataSectionObject; /* +0x0000 */ void *SharedCacheMap; /* +0x0004 */ void *ImageSectionObject; /* +0x0008 */ }; struct tagSAFEARRAY { unsigned short cDims; /* +0x0000 */ unsigned short fFeatures; /* +0x0002 */ unsigned long cbElements; /* +0x0004 */ unsigned long cLocks; /* +0x0008 */ void *pvData; /* +0x000c */ unsigned char rgsabound[8]; /* +0x0010 69 1d 00 00 */ }; struct _LUID_AND_ATTRIBUTES { unsigned char Luid[8]; /* +0x0000 f2 10 00 00 */ unsigned long Attributes; /* +0x0008 */ }; struct _KDEVICE_QUEUE { short Type; /* +0x0000 */ short Size; /* +0x0002 */ unsigned char DeviceListHead[8]; /* +0x0004 80 10 00 00 */ unsigned long Lock; /* +0x000c */ unsigned char Busy; /* +0x0010 */ }; enum _OB_OPEN_REASON { ObCreateHandle = 0, ObOpenHandle = 1, ObDuplicateHandle = 2, ObInheritHandle = 3, ObMaxOpenReason = 4 }; enum _SECURITY_OPERATION_CODE { SetSecurityDescriptor = 0, QuerySecurityDescriptor = 1, DeleteSecurityDescriptor = 2, AssignSecurityDescriptor = 3 }; struct _OBJECT_TYPE_INITIALIZER { unsigned short Length; /* +0x0000 */ unsigned char ObjectTypeFlags; /* +0x0002 */ /* unsigned char CaseInsensitive[0]; +0x0002 06 11 00 00 */ /* unsigned char UnnamedObjectsOnly[0]; +0x0002 1d 1b 00 00 */ /* unsigned char UseDefaultObject[0]; +0x0002 1e 1b 00 00 */ /* unsigned char SecurityRequired[0]; +0x0002 1f 1b 00 00 */ /* unsigned char MaintainHandleCount[0]; +0x0002 24 1c 00 00 */ /* unsigned char MaintainTypeList[0]; +0x0002 71 1d 00 00 */ /* unsigned char SupportsObjectCallbacks[0]; +0x0002 22 1b 00 00 */ unsigned char CacheAligned[2]; /* +0x0002 72 1d 00 00 */ unsigned long ObjectTypeCode; /* +0x0004 */ unsigned long InvalidAttributes; /* +0x0008 */ unsigned char GenericMapping[16]; /* +0x000c 30 12 00 00 */ unsigned long ValidAccessMask; /* +0x001c */ unsigned long RetainAccess; /* +0x0020 */ unsigned char PoolType[4]; /* +0x0024 63 11 00 00 */ unsigned long DefaultPagedPoolCharge; /* +0x0028 */ unsigned long DefaultNonPagedPoolCharge; /* +0x002c */ unsigned char DumpProcedure[4]; /* +0x0030 77 1d 00 00 */ unsigned char OpenProcedure[4]; /* +0x0034 7c 1d 00 00 */ unsigned char CloseProcedure[4]; /* +0x0038 7f 1d 00 00 */ unsigned char DeleteProcedure[4]; /* +0x003c 6f 11 00 00 */ unsigned char ParseProcedure[4]; /* +0x0040 82 1d 00 00 */ unsigned char SecurityProcedure[4]; /* +0x0044 88 1d 00 00 */ unsigned char QueryNameProcedure[4]; /* +0x0048 8d 1d 00 00 */ unsigned char OkayToCloseProcedure[4]; /* +0x004c 90 1d 00 00 */ unsigned long WaitObjectFlagMask; /* +0x0050 */ unsigned short WaitObjectFlagOffset; /* +0x0054 */ unsigned short WaitObjectPointerOffset; /* +0x0056 */ }; struct _OBJECT_TYPE_INITIALIZER:: { unsigned char ObjectTypeFlags; /* +0x0000 */ /* unsigned char CaseInsensitive[0]; +0x0000 06 11 00 00 */ /* unsigned char UnnamedObjectsOnly[0]; +0x0000 1d 1b 00 00 */ /* unsigned char UseDefaultObject[0]; +0x0000 1e 1b 00 00 */ /* unsigned char SecurityRequired[0]; +0x0000 1f 1b 00 00 */ /* unsigned char MaintainHandleCount[0]; +0x0000 24 1c 00 00 */ /* unsigned char MaintainTypeList[0]; +0x0000 71 1d 00 00 */ /* unsigned char SupportsObjectCallbacks[0]; +0x0000 22 1b 00 00 */ unsigned char CacheAligned[1]; /* +0x0000 72 1d 00 00 */ }; struct _OBJECT_TYPE_INITIALIZER:::: { /* unsigned char CaseInsensitive[0]; +0x0000 06 11 00 00 */ /* unsigned char UnnamedObjectsOnly[0]; +0x0000 1d 1b 00 00 */ /* unsigned char UseDefaultObject[0]; +0x0000 1e 1b 00 00 */ /* unsigned char SecurityRequired[0]; +0x0000 1f 1b 00 00 */ /* unsigned char MaintainHandleCount[0]; +0x0000 24 1c 00 00 */ /* unsigned char MaintainTypeList[0]; +0x0000 71 1d 00 00 */ /* unsigned char SupportsObjectCallbacks[0]; +0x0000 22 1b 00 00 */ unsigned char CacheAligned[1]; /* +0x0000 72 1d 00 00 */ }; enum CWMO_FLAGS { CWMO_DISPATCH_CALLS = 1, CWMO_DISPATCH_WINDOW_MESSAGES = 2, REAL_CWMO_ENABLE_CALL_REENTRANCY = 1, CWMO_ENABLE_WINDOW_MESSAGES = 2, CWMO_ENABLE_CALL_REENTRANCY = 3 }; enum _tagPSUACTION { PSU_DEFAULT = 1, PSU_SECURITY_URL_ONLY = 2 }; enum WDF_MODULE_INFO_CHANGE_TYPE { ModuleLoaded = 0, ModuleUnloaded = 1 }; enum tagGLOBALOPT_EH_VALUES { COMGLB_EXCEPTION_HANDLE = 0, COMGLB_EXCEPTION_DONOT_HANDLE_FATAL = 1, COMGLB_EXCEPTION_DONOT_HANDLE = 1, COMGLB_EXCEPTION_DONOT_HANDLE_ANY = 2 }; struct _IO_STACK_LOCATION:::: { unsigned char SecurityContext[4]; /* +0x0000 a2 1d 00 00 */ unsigned long Options; /* +0x0004 */ unsigned short FileAttributes; /* +0x0008 */ unsigned short ShareAccess; /* +0x000a */ unsigned long EaLength; /* +0x000c */ }; struct _IO_STACK_LOCATION:::: { unsigned char SecurityContext[4]; /* +0x0000 a2 1d 00 00 */ unsigned long Options; /* +0x0004 */ unsigned short Reserved; /* +0x0008 */ unsigned short ShareAccess; /* +0x000a */ unsigned char Parameters[4]; /* +0x000c a6 1d 00 00 */ }; struct _IO_STACK_LOCATION:::: { unsigned char SecurityContext[4]; /* +0x0000 a2 1d 00 00 */ unsigned long Options; /* +0x0004 */ unsigned short Reserved; /* +0x0008 */ unsigned short ShareAccess; /* +0x000a */ unsigned char Parameters[4]; /* +0x000c aa 1d 00 00 */ }; struct _IO_STACK_LOCATION:::: { unsigned long Length; /* +0x0000 */ unsigned long Key; /* +0x0004 */ unsigned char ByteOffset[8]; /* +0x0008 34 10 00 00 */ }; struct _IO_STACK_LOCATION:::: { unsigned long Length; /* +0x0000 */ unsigned char FileName[4]; /* +0x0004 e3 10 00 00 */ unsigned char FileInformationClass[4]; /* +0x0008 72 19 00 00 */ unsigned long FileIndex; /* +0x000c */ }; struct _IO_STACK_LOCATION:::: { unsigned long Length; /* +0x0000 */ unsigned long CompletionFilter; /* +0x0004 */ }; struct _IO_STACK_LOCATION:::: { unsigned long Length; /* +0x0000 */ unsigned char FileInformationClass[4]; /* +0x0004 72 19 00 00 */ }; struct _IO_STACK_LOCATION:::: { unsigned long Length; /* +0x0000 */ unsigned char FileInformationClass[4]; /* +0x0004 72 19 00 00 */ unsigned char FileObject[4]; /* +0x0008 e0 11 00 00 */ unsigned char ReplaceIfExists; /* +0x000c */ unsigned char AdvanceOnly; /* +0x000d */ unsigned long ClusterCount; /* +0x000c */ void *DeleteHandle; /* +0x000c */ }; struct _IO_STACK_LOCATION:::::: { unsigned char ReplaceIfExists; /* +0x0000 */ unsigned char AdvanceOnly; /* +0x0001 */ unsigned long ClusterCount; /* +0x0000 */ void *DeleteHandle; /* +0x0000 */ }; struct _IO_STACK_LOCATION:::::::: { unsigned char ReplaceIfExists; /* +0x0000 */ unsigned char AdvanceOnly; /* +0x0001 */ }; enum _FSINFOCLASS { FileFsVolumeInformation = 1, FileFsLabelInformation = 2, FileFsSizeInformation = 3, FileFsDeviceInformation = 4, FileFsAttributeInformation = 5, FileFsControlInformation = 6, FileFsFullSizeInformation = 7, FileFsObjectIdInformation = 8, FileFsDriverPathInformation = 9, FileFsVolumeFlagsInformation = 10, FileFsSectorSizeInformation = 11, FileFsMaximumInformation = 12 }; struct _IO_STACK_LOCATION:::: { unsigned long Length; /* +0x0000 */ unsigned char FsInformationClass[4]; /* +0x0004 bd 1d 00 00 */ }; struct _IO_STACK_LOCATION:::: { unsigned long OutputBufferLength; /* +0x0000 */ unsigned long InputBufferLength; /* +0x0004 */ unsigned long FsControlCode; /* +0x0008 */ void *Type3InputBuffer; /* +0x000c */ }; struct _IO_STACK_LOCATION:::: { unsigned char Length[4]; /* +0x0000 33 1a 00 00 */ unsigned long Key; /* +0x0004 */ unsigned char ByteOffset[8]; /* +0x0008 34 10 00 00 */ }; struct _IO_STACK_LOCATION:::: { unsigned long OutputBufferLength; /* +0x0000 */ unsigned long InputBufferLength; /* +0x0004 */ unsigned long IoControlCode; /* +0x0008 */ void *Type3InputBuffer; /* +0x000c */ }; struct _IO_STACK_LOCATION:::: { unsigned long SecurityInformation; /* +0x0000 */ unsigned long Length; /* +0x0004 */ }; struct _IO_STACK_LOCATION:::: { unsigned long SecurityInformation; /* +0x0000 */ void *SecurityDescriptor; /* +0x0004 */ }; struct _IO_STACK_LOCATION:::: { unsigned char Vpb[4]; /* +0x0000 f8 11 00 00 */ unsigned char DeviceObject[4]; /* +0x0004 ca 11 00 00 */ }; struct _IO_STACK_LOCATION:::: { unsigned char Srb[4]; /* +0x0000 ce 1d 00 00 */ }; enum _DEVICE_RELATION_TYPE { BusRelations = 0, EjectionRelations = 1, PowerRelations = 2, RemovalRelations = 3, TargetDeviceRelation = 4, SingleBusRelations = 5, TransportRelations = 6 }; struct _IO_STACK_LOCATION:::: { unsigned char Type[4]; /* +0x0000 d2 1d 00 00 */ }; struct _IO_STACK_LOCATION:::: { unsigned char InterfaceType[4]; /* +0x0000 15 10 00 00 */ unsigned short Size; /* +0x0004 */ unsigned short Version; /* +0x0006 */ unsigned char Interface[4]; /* +0x0008 d6 1d 00 00 */ void *InterfaceSpecificData; /* +0x000c */ }; struct _IO_STACK_LOCATION:::: { unsigned char Capabilities[4]; /* +0x0000 da 1d 00 00 */ }; struct _IO_STACK_LOCATION:::: { unsigned char IoResourceRequirementList[4]; /* +0x0000 9f 19 00 00 */ }; struct _IO_STACK_LOCATION:::: { unsigned long WhichSpace; /* +0x0000 */ void *Buffer; /* +0x0004 */ unsigned long Offset; /* +0x0008 */ unsigned long Length; /* +0x000c */ }; struct _IO_STACK_LOCATION:::: { unsigned char Lock; /* +0x0000 */ }; enum BUS_QUERY_ID_TYPE { BusQueryDeviceID = 0, BusQueryHardwareIDs = 1, BusQueryCompatibleIDs = 2, BusQueryInstanceID = 3, BusQueryDeviceSerialNumber = 4, BusQueryContainerID = 5 }; struct _IO_STACK_LOCATION:::: { unsigned char IdType[4]; /* +0x0000 e4 1d 00 00 */ }; enum DEVICE_TEXT_TYPE { DeviceTextDescription = 0, DeviceTextLocationInformation = 1 }; struct _IO_STACK_LOCATION:::: { unsigned char DeviceTextType[4]; /* +0x0000 e8 1d 00 00 */ unsigned long LocaleId; /* +0x0004 */ }; enum _DEVICE_USAGE_NOTIFICATION_TYPE { DeviceUsageTypeUndefined = 0, DeviceUsageTypePaging = 1, DeviceUsageTypeHibernation = 2, DeviceUsageTypeDumpFile = 3, DeviceUsageTypeBoot = 4 }; struct _IO_STACK_LOCATION:::: { unsigned char InPath; /* +0x0000 */ unsigned char Reserved[3]; /* +0x0001 3a 10 00 00 */ unsigned char Type[4]; /* +0x0004 ec 1d 00 00 */ }; enum _SYSTEM_POWER_STATE { PowerSystemUnspecified = 0, PowerSystemWorking = 1, PowerSystemSleeping1 = 2, PowerSystemSleeping2 = 3, PowerSystemSleeping3 = 4, PowerSystemHibernate = 5, PowerSystemShutdown = 6, PowerSystemMaximum = 7 }; struct _IO_STACK_LOCATION:::: { unsigned char PowerState[4]; /* +0x0000 f0 1d 00 00 */ }; struct _IO_STACK_LOCATION:::: { unsigned char PowerSequence[4]; /* +0x0000 f4 1d 00 00 */ }; enum POWER_ACTION { PowerActionNone = 0, PowerActionReserved = 1, PowerActionSleep = 2, PowerActionHibernate = 3, PowerActionShutdown = 4, PowerActionShutdownReset = 5, PowerActionShutdownOff = 6, PowerActionWarmEject = 7 }; struct _IO_STACK_LOCATION:::: { unsigned long SystemContext; /* +0x0000 */ unsigned char SystemPowerStateContext[4]; /* +0x0000 f7 1d 00 00 */ unsigned char Type[4]; /* +0x0004 54 19 00 00 */ unsigned char State[4]; /* +0x0008 5f 17 00 00 */ unsigned char ShutdownType[4]; /* +0x000c f9 1d 00 00 */ }; struct _IO_STACK_LOCATION:::::: { unsigned long SystemContext; /* +0x0000 */ unsigned char SystemPowerStateContext[4]; /* +0x0000 f7 1d 00 00 */ }; struct _IO_STACK_LOCATION:::: { unsigned char AllocatedResources[4]; /* +0x0000 b4 17 00 00 */ unsigned char AllocatedResourcesTranslated[4]; /* +0x0004 b4 17 00 00 */ }; struct _IO_STACK_LOCATION:::: { unsigned long ProviderId; /* +0x0000 */ void *DataPath; /* +0x0004 */ unsigned long BufferSize; /* +0x0008 */ void *Buffer; /* +0x000c */ }; struct _WHEA_TIMESTAMP { /* unsigned char Seconds[0]; +0x0000 02 1e 00 00 */ /* unsigned char Minutes[0]; +0x0000 03 1e 00 00 */ /* unsigned char Hours[0]; +0x0000 04 1e 00 00 */ /* unsigned char Precise[0]; +0x0000 05 1e 00 00 */ /* unsigned char Reserved[0]; +0x0000 06 1e 00 00 */ /* unsigned char Day[0]; +0x0000 07 1e 00 00 */ /* unsigned char Month[0]; +0x0000 08 1e 00 00 */ /* unsigned char Year[0]; +0x0000 09 1e 00 00 */ /* unsigned char Century[0]; +0x0000 0a 1e 00 00 */ unsigned char AsLARGE_INTEGER[8]; /* +0x0000 34 10 00 00 */ }; enum __MIDL_IUri_0002 { Uri_HOST_UNKNOWN = 0, Uri_HOST_DNS = 1, Uri_HOST_IPV4 = 2, Uri_HOST_IPV6 = 3, Uri_HOST_IDN = 4 }; struct _VPB { short Type; /* +0x0000 */ short Size; /* +0x0002 */ unsigned short Flags; /* +0x0004 */ unsigned short VolumeLabelLength; /* +0x0006 */ unsigned char DeviceObject[4]; /* +0x0008 ca 11 00 00 */ unsigned char RealDevice[4]; /* +0x000c ca 11 00 00 */ unsigned long SerialNumber; /* +0x0010 */ unsigned long ReferenceCount; /* +0x0014 */ unsigned char VolumeLabel[64]; /* +0x0018 0f 1e 00 00 */ }; struct _PORT_MESSAGE:::: { short DataLength; /* +0x0000 */ short TotalLength; /* +0x0002 */ }; struct _PORT_MESSAGE:::: { short Type; /* +0x0000 */ short DataInfoOffset; /* +0x0002 */ }; struct _PORT_MESSAGE:: { /* unsigned char ClientId[0]; +0x0000 93 10 00 00 */ unsigned char DoNotUseThisField[8]; /* +0x0000 41 00 00 00 */ }; struct _PORT_MESSAGE:: { unsigned long ClientViewSize; /* +0x0000 */ unsigned long CallbackId; /* +0x0000 */ }; struct _INTERFACE { unsigned short Size; /* +0x0000 */ unsigned short Version; /* +0x0002 */ void *Context; /* +0x0004 */ unsigned char InterfaceReference[4]; /* +0x0008 6f 11 00 00 */ unsigned char InterfaceDereference[4]; /* +0x000c 6f 11 00 00 */ }; struct _SECURITY_SUBJECT_CONTEXT { void *ClientToken; /* +0x0000 */ unsigned char ImpersonationLevel[4]; /* +0x0004 de 15 00 00 */ void *PrimaryToken; /* +0x0008 */ void *ProcessAuditId; /* +0x000c */ }; struct tagSTATSTG { unsigned char pwcsName[4]; /* +0x0000 71 04 00 00 */ unsigned long type; /* +0x0004 */ unsigned char cbSize[8]; /* +0x0008 4c 10 00 00 */ unsigned char mtime[8]; /* +0x0010 f8 12 00 00 */ unsigned char ctime[8]; /* +0x0018 f8 12 00 00 */ unsigned char atime[8]; /* +0x0020 f8 12 00 00 */ unsigned long grfMode; /* +0x0028 */ unsigned long grfLocksSupported; /* +0x002c */ unsigned char clsid[16]; /* +0x0030 13 10 00 00 */ unsigned long grfStateBits; /* +0x0040 */ unsigned long reserved; /* +0x0044 */ }; enum _MEMORY_CACHING_TYPE_ORIG { MmFrameBufferCached = 2 }; struct $_s__RTTIBaseClassArray$_extraBytes_52 { unsigned char arrayOfBaseClassDescriptors[53]; /* +0x0000 29 1e 00 00 */ }; enum _EXCEPTION_DISPOSITION { ExceptionContinueExecution = 0, ExceptionContinueSearch = 1, ExceptionNestedException = 2, ExceptionCollidedUnwind = 3 }; struct _EXCEPTION_REGISTRATION_RECORD { unsigned char Next[4]; /* +0x0000 7f 1b 00 00 */ unsigned char Handler[4]; /* +0x0004 34 1e 00 00 */ }; struct $_TypeDescriptor$_extraBytes_23 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[23]; /* +0x0008 38 1e 00 00 */ }; struct _DEVICE_OBJECT:: { /* unsigned char ListEntry[0]; +0x0000 80 10 00 00 */ unsigned char Wcb[40]; /* +0x0000 3b 1e 00 00 */ }; struct tagDISPPARAMS { unsigned char rgvarg[4]; /* +0x0000 04 1c 00 00 */ long *rgdispidNamedArgs; /* +0x0004 */ unsigned char cArgs[4]; /* +0x0008 75 00 00 00 */ unsigned char cNamedArgs[4]; /* +0x000c 75 00 00 00 */ }; enum _KSPIN_LOCK_QUEUE_NUMBER { LockQueueUnusedSpare0 = 0, LockQueueExpansionLock = 1, LockQueueUnusedSpare2 = 2, LockQueueSystemSpaceLock = 3, LockQueueVacbLock = 4, LockQueueMasterLock = 5, LockQueueNonPagedPoolLock = 6, LockQueueIoCancelLock = 7, LockQueueWorkQueueLock = 8, LockQueueIoVpbLock = 9, LockQueueIoDatabaseLock = 10, LockQueueIoCompletionLock = 11, LockQueueNtfsStructLock = 12, LockQueueAfdWorkQueueLock = 13, LockQueueBcbLock = 14, LockQueueMmNonPagedPoolLock = 15, LockQueueUnusedSpare16 = 16, LockQueueMaximumLock = 17 }; struct _POWER_STATE { /* unsigned char SystemState[0]; +0x0000 f0 1d 00 00 */ unsigned char DeviceState[4]; /* +0x0000 15 12 00 00 */ }; struct _CONTEXT { unsigned long ContextFlags; /* +0x0000 */ unsigned long Dr0; /* +0x0004 */ unsigned long Dr1; /* +0x0008 */ unsigned long Dr2; /* +0x000c */ unsigned long Dr3; /* +0x0010 */ unsigned long Dr6; /* +0x0014 */ unsigned long Dr7; /* +0x0018 */ unsigned char FloatSave[112]; /* +0x001c 45 1e 00 00 */ unsigned long SegGs; /* +0x008c */ unsigned long SegFs; /* +0x0090 */ unsigned long SegEs; /* +0x0094 */ unsigned long SegDs; /* +0x0098 */ unsigned long Edi; /* +0x009c */ unsigned long Esi; /* +0x00a0 */ unsigned long Ebx; /* +0x00a4 */ unsigned long Edx; /* +0x00a8 */ unsigned long Ecx; /* +0x00ac */ unsigned long Eax; /* +0x00b0 */ unsigned long Ebp; /* +0x00b4 */ unsigned long Eip; /* +0x00b8 */ unsigned long SegCs; /* +0x00bc */ unsigned long EFlags; /* +0x00c0 */ unsigned long Esp; /* +0x00c4 */ unsigned long SegSs; /* +0x00c8 */ unsigned char ExtendedRegisters[512]; /* +0x00cc 46 1e 00 00 */ }; struct tagCAFILETIME { unsigned long cElems; /* +0x0000 */ unsigned char pElems[4]; /* +0x0004 49 1e 00 00 */ }; struct _COMPLETION_SYNCHRONIZER { unsigned char DoneWithIrp[4]; /* +0x0000 1f 10 00 00 */ unsigned char PnpTracker[4]; /* +0x0004 c0 18 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR { unsigned char Type; /* +0x0000 */ unsigned char ShareDisposition; /* +0x0001 */ unsigned short Flags; /* +0x0002 */ }; struct _IMAGE_OPTIONAL_HEADER { unsigned short Magic; /* +0x0000 */ unsigned char MajorLinkerVersion; /* +0x0002 */ unsigned char MinorLinkerVersion; /* +0x0003 */ unsigned long SizeOfCode; /* +0x0004 */ unsigned long SizeOfInitializedData; /* +0x0008 */ unsigned long SizeOfUninitializedData; /* +0x000c */ unsigned long AddressOfEntryPoint; /* +0x0010 */ unsigned long BaseOfCode; /* +0x0014 */ unsigned long BaseOfData; /* +0x0018 */ unsigned long ImageBase; /* +0x001c */ unsigned long SectionAlignment; /* +0x0020 */ unsigned long FileAlignment; /* +0x0024 */ unsigned short MajorOperatingSystemVersion; /* +0x0028 */ unsigned short MinorOperatingSystemVersion; /* +0x002a */ unsigned short MajorImageVersion; /* +0x002c */ unsigned short MinorImageVersion; /* +0x002e */ unsigned short MajorSubsystemVersion; /* +0x0030 */ unsigned short MinorSubsystemVersion; /* +0x0032 */ unsigned long Win32VersionValue; /* +0x0034 */ unsigned long SizeOfImage; /* +0x0038 */ unsigned long SizeOfHeaders; /* +0x003c */ unsigned long CheckSum; /* +0x0040 */ unsigned short Subsystem; /* +0x0044 */ unsigned short DllCharacteristics; /* +0x0046 */ unsigned long SizeOfStackReserve; /* +0x0048 */ unsigned long SizeOfStackCommit; /* +0x004c */ unsigned long SizeOfHeapReserve; /* +0x0050 */ unsigned long SizeOfHeapCommit; /* +0x0054 */ unsigned long LoaderFlags; /* +0x0058 */ unsigned long NumberOfRvaAndSizes; /* +0x005c */ unsigned char DataDirectory[128]; /* +0x0060 52 1e 00 00 */ }; struct _PEB:: { unsigned char BitField; /* +0x0000 */ /* unsigned char ImageUsesLargePages[0]; +0x0000 06 11 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0000 1d 1b 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0000 1e 1b 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0000 1f 1b 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0000 24 1c 00 00 */ unsigned char SpareBits[1]; /* +0x0000 25 1c 00 00 */ }; struct _PEB:::: { /* unsigned char ImageUsesLargePages[0]; +0x0000 06 11 00 00 */ /* unsigned char IsProtectedProcess[0]; +0x0000 1d 1b 00 00 */ /* unsigned char IsLegacyProcess[0]; +0x0000 1e 1b 00 00 */ /* unsigned char IsImageDynamicallyRelocated[0]; +0x0000 1f 1b 00 00 */ /* unsigned char SkipPatchingUser32Forwarders[0]; +0x0000 24 1c 00 00 */ unsigned char SpareBits[1]; /* +0x0000 25 1c 00 00 */ }; struct _PEB:: { unsigned long CrossProcessFlags; /* +0x0000 */ /* unsigned char ProcessInJob[0]; +0x0000 3b 10 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0000 3c 10 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0000 3d 10 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0000 3e 10 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0000 3f 10 00 00 */ unsigned char ReservedBits0[4]; /* +0x0000 2c 1c 00 00 */ }; struct _PEB:::: { /* unsigned char ProcessInJob[0]; +0x0000 3b 10 00 00 */ /* unsigned char ProcessInitializing[0]; +0x0000 3c 10 00 00 */ /* unsigned char ProcessUsingVEH[0]; +0x0000 3d 10 00 00 */ /* unsigned char ProcessUsingVCH[0]; +0x0000 3e 10 00 00 */ /* unsigned char ProcessUsingFTH[0]; +0x0000 3f 10 00 00 */ unsigned char ReservedBits0[4]; /* +0x0000 2c 1c 00 00 */ }; struct _PEB:: { void *KernelCallbackTable; /* +0x0000 */ void *UserSharedInfoPtr; /* +0x0000 */ }; struct _PEB:: { unsigned long TracingFlags; /* +0x0000 */ /* unsigned char HeapTracingEnabled[0]; +0x0000 3b 10 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0000 3c 10 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0000 3d 10 00 00 */ unsigned char SpareTracingBits[4]; /* +0x0000 37 1c 00 00 */ }; struct _PEB:::: { /* unsigned char HeapTracingEnabled[0]; +0x0000 3b 10 00 00 */ /* unsigned char CritSecTracingEnabled[0]; +0x0000 3c 10 00 00 */ /* unsigned char LibLoaderTracingEnabled[0]; +0x0000 3d 10 00 00 */ unsigned char SpareTracingBits[4]; /* +0x0000 37 1c 00 00 */ }; struct _WHEA_TIMESTAMP:: { /* unsigned char Seconds[0]; +0x0000 02 1e 00 00 */ /* unsigned char Minutes[0]; +0x0000 03 1e 00 00 */ /* unsigned char Hours[0]; +0x0000 04 1e 00 00 */ /* unsigned char Precise[0]; +0x0000 05 1e 00 00 */ /* unsigned char Reserved[0]; +0x0000 06 1e 00 00 */ /* unsigned char Day[0]; +0x0000 07 1e 00 00 */ /* unsigned char Month[0]; +0x0000 08 1e 00 00 */ /* unsigned char Year[0]; +0x0000 09 1e 00 00 */ unsigned char Century[8]; /* +0x0000 0a 1e 00 00 */ }; struct _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS { /* unsigned char FRUId[0]; +0x0000 06 11 00 00 */ /* unsigned char FRUText[0]; +0x0000 1d 1b 00 00 */ /* unsigned char Reserved[0]; +0x0000 66 1e 00 00 */ unsigned char AsUCHAR; /* +0x0000 */ }; struct _IO_RESOURCE_LIST { unsigned short Version; /* +0x0000 */ unsigned short Revision; /* +0x0002 */ unsigned long Count; /* +0x0004 */ unsigned char Descriptors[32]; /* +0x0008 69 1e 00 00 */ }; struct _WHEA_ERROR_RECORD_HEADER_FLAGS { /* unsigned char Recovered[0]; +0x0000 3b 10 00 00 */ /* unsigned char PreviousError[0]; +0x0000 3c 10 00 00 */ /* unsigned char Simulated[0]; +0x0000 3d 10 00 00 */ /* unsigned char Reserved[0]; +0x0000 37 1c 00 00 */ unsigned long AsULONG; /* +0x0000 */ }; struct _WHEA_ERROR_RECORD_HEADER_FLAGS:: { /* unsigned char Recovered[0]; +0x0000 3b 10 00 00 */ /* unsigned char PreviousError[0]; +0x0000 3c 10 00 00 */ /* unsigned char Simulated[0]; +0x0000 3d 10 00 00 */ unsigned char Reserved[4]; /* +0x0000 37 1c 00 00 */ }; struct _EVENT_TRACE_HEADER:: { unsigned short FieldTypeFlags; /* +0x0000 */ unsigned char HeaderType; /* +0x0000 */ unsigned char MarkerFlags; /* +0x0001 */ }; struct _EVENT_TRACE_HEADER:::: { unsigned char HeaderType; /* +0x0000 */ unsigned char MarkerFlags; /* +0x0001 */ }; struct _EVENT_TRACE_HEADER:: { unsigned long Version; /* +0x0000 */ }; struct _EVENT_TRACE_HEADER:: { /* unsigned char Guid[0]; +0x0000 13 10 00 00 */ unsigned long long GuidPtr; /* +0x0000 */ }; struct _EVENT_TRACE_HEADER:: { unsigned long KernelTime; /* +0x0000 */ unsigned long UserTime; /* +0x0004 */ unsigned long long ProcessorTime; /* +0x0000 */ unsigned long ClientContext; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ }; struct _EVENT_TRACE_HEADER:::: { unsigned long KernelTime; /* +0x0000 */ unsigned long UserTime; /* +0x0004 */ }; struct _EVENT_TRACE_HEADER:::: { unsigned long ClientContext; /* +0x0000 */ unsigned long Flags; /* +0x0004 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 34 10 00 00 */ unsigned long Length; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned short Level; /* +0x0000 */ unsigned short Group; /* +0x0002 */ unsigned long Vector; /* +0x0004 */ unsigned long Affinity; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { /* unsigned char Raw[0]; +0x0000 b5 1e 00 00 */ unsigned char Translated[12]; /* +0x0000 b6 1e 00 00 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::::::: { unsigned short Group; /* +0x0000 */ unsigned short MessageCount; /* +0x0002 */ unsigned long Vector; /* +0x0004 */ unsigned long Affinity; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Channel; /* +0x0000 */ unsigned long Port; /* +0x0004 */ unsigned long Reserved1; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Channel; /* +0x0000 */ unsigned long RequestLine; /* +0x0004 */ unsigned long Reserved1; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long Start; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Reserved; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned long DataSize; /* +0x0000 */ unsigned long Reserved1; /* +0x0004 */ unsigned long Reserved2; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 34 10 00 00 */ unsigned long Length40; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 34 10 00 00 */ unsigned long Length48; /* +0x0008 */ }; struct _CM_PARTIAL_RESOURCE_DESCRIPTOR:::: { unsigned char Start[8]; /* +0x0000 34 10 00 00 */ unsigned long Length64; /* +0x0008 */ }; enum _IO_ALLOCATION_ACTION { KeepObject = 1, DeallocateObject = 2, DeallocateObjectKeepRegisters = 3 }; struct _WAIT_CONTEXT_BLOCK { /* unsigned char WaitQueueEntry[0]; +0x0000 d9 11 00 00 */ unsigned char DmaWaitEntry[8]; /* +0x0000 80 10 00 00 */ unsigned long NumberOfChannels; /* +0x0008 */ /* unsigned char SyncCallback[0]; +0x000c 3b 10 00 00 */ /* unsigned char DmaContext[0]; +0x000c 3c 10 00 00 */ unsigned char Reserved[4]; /* +0x000c 78 10 00 00 */ unsigned char DeviceRoutine[4]; /* +0x0010 d3 1e 00 00 */ void *DeviceContext; /* +0x0014 */ unsigned long NumberOfMapRegisters; /* +0x0018 */ void *DeviceObject; /* +0x001c */ void *CurrentIrp; /* +0x0020 */ unsigned char BufferChainingDpc[4]; /* +0x0024 ed 11 00 00 */ }; struct _WAIT_CONTEXT_BLOCK:: { /* unsigned char WaitQueueEntry[0]; +0x0000 d9 11 00 00 */ unsigned char DmaWaitEntry[8]; /* +0x0000 80 10 00 00 */ unsigned long NumberOfChannels; /* +0x0008 */ /* unsigned char SyncCallback[0]; +0x000c 3b 10 00 00 */ /* unsigned char DmaContext[0]; +0x000c 3c 10 00 00 */ unsigned char Reserved[4]; /* +0x000c 78 10 00 00 */ }; struct _WAIT_CONTEXT_BLOCK:::: { unsigned char DmaWaitEntry[8]; /* +0x0000 80 10 00 00 */ unsigned long NumberOfChannels; /* +0x0008 */ /* unsigned char SyncCallback[0]; +0x000c 3b 10 00 00 */ /* unsigned char DmaContext[0]; +0x000c 3c 10 00 00 */ unsigned char Reserved[4]; /* +0x000c 78 10 00 00 */ }; struct _IO_REMOVE_LOCK_COMMON_BLOCK { unsigned char Removed; /* +0x0000 */ unsigned char Reserved[3]; /* +0x0001 3a 10 00 00 */ long IoCount; /* +0x0004 */ unsigned char RemoveEvent[16]; /* +0x0008 4b 11 00 00 */ }; struct $_TypeDescriptor$_extraBytes_20 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[20]; /* +0x0008 64 12 00 00 */ }; struct tagVARIANT:::: { unsigned short vt; /* +0x0000 */ unsigned short wReserved1; /* +0x0002 */ unsigned short wReserved2; /* +0x0004 */ unsigned short wReserved3; /* +0x0006 */ long long llVal; /* +0x0008 */ long lVal; /* +0x0008 */ unsigned char bVal; /* +0x0008 */ short iVal; /* +0x0008 */ /* unsigned char fltVal[0]; +0x0008 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0008 41 00 00 00 */ short boolVal; /* +0x0008 */ long scode; /* +0x0008 */ /* unsigned char cyVal[0]; +0x0008 f7 12 00 00 */ /* unsigned char date[0]; +0x0008 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0008 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0008 fe 12 00 00 */ /* unsigned char pdispVal[0]; +0x0008 00 13 00 00 */ /* unsigned char parray[0]; +0x0008 08 13 00 00 */ unsigned char *pbVal; /* +0x0008 */ short *piVal; /* +0x0008 */ long *plVal; /* +0x0008 */ long long *pllVal; /* +0x0008 */ /* unsigned char pfltVal[0]; +0x0008 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0008 41 04 00 00 */ short *pboolVal; /* +0x0008 */ long *pscode; /* +0x0008 */ /* unsigned char pcyVal[0]; +0x0008 21 13 00 00 */ /* unsigned char pdate[0]; +0x0008 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0008 e6 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0008 22 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0008 23 13 00 00 */ /* unsigned char pparray[0]; +0x0008 24 13 00 00 */ /* unsigned char pvarVal[0]; +0x0008 04 1c 00 00 */ void *byref; /* +0x0008 */ char cVal; /* +0x0008 */ unsigned short uiVal; /* +0x0008 */ unsigned long ulVal; /* +0x0008 */ unsigned long long ullVal; /* +0x0008 */ /* unsigned char intVal[0]; +0x0008 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0008 75 00 00 00 */ /* unsigned char pdecVal[0]; +0x0008 20 13 00 00 */ char *pcVal; /* +0x0008 */ unsigned short *puiVal; /* +0x0008 */ unsigned long *pulVal; /* +0x0008 */ unsigned long long *pullVal; /* +0x0008 */ /* unsigned char pintVal[0]; +0x0008 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0008 75 04 00 00 */ void *pvRecord; /* +0x0008 */ unsigned char pRecInfo[4]; /* +0x000c 16 1c 00 00 */ }; struct tagVARIANT:::::: { long long llVal; /* +0x0000 */ long lVal; /* +0x0000 */ unsigned char bVal; /* +0x0000 */ short iVal; /* +0x0000 */ /* unsigned char fltVal[0]; +0x0000 40 00 00 00 */ /* unsigned char dblVal[0]; +0x0000 41 00 00 00 */ short boolVal; /* +0x0000 */ long scode; /* +0x0000 */ /* unsigned char cyVal[0]; +0x0000 f7 12 00 00 */ /* unsigned char date[0]; +0x0000 41 00 00 00 */ /* unsigned char bstrVal[0]; +0x0000 71 04 00 00 */ /* unsigned char punkVal[0]; +0x0000 fe 12 00 00 */ /* unsigned char pdispVal[0]; +0x0000 00 13 00 00 */ /* unsigned char parray[0]; +0x0000 08 13 00 00 */ unsigned char *pbVal; /* +0x0000 */ short *piVal; /* +0x0000 */ long *plVal; /* +0x0000 */ long long *pllVal; /* +0x0000 */ /* unsigned char pfltVal[0]; +0x0000 40 04 00 00 */ /* unsigned char pdblVal[0]; +0x0000 41 04 00 00 */ short *pboolVal; /* +0x0000 */ long *pscode; /* +0x0000 */ /* unsigned char pcyVal[0]; +0x0000 21 13 00 00 */ /* unsigned char pdate[0]; +0x0000 41 04 00 00 */ /* unsigned char pbstrVal[0]; +0x0000 e6 10 00 00 */ /* unsigned char ppunkVal[0]; +0x0000 22 13 00 00 */ /* unsigned char ppdispVal[0]; +0x0000 23 13 00 00 */ /* unsigned char pparray[0]; +0x0000 24 13 00 00 */ /* unsigned char pvarVal[0]; +0x0000 04 1c 00 00 */ void *byref; /* +0x0000 */ char cVal; /* +0x0000 */ unsigned short uiVal; /* +0x0000 */ unsigned long ulVal; /* +0x0000 */ unsigned long long ullVal; /* +0x0000 */ /* unsigned char intVal[0]; +0x0000 74 00 00 00 */ /* unsigned char uintVal[0]; +0x0000 75 00 00 00 */ /* unsigned char pdecVal[0]; +0x0000 20 13 00 00 */ char *pcVal; /* +0x0000 */ unsigned short *puiVal; /* +0x0000 */ unsigned long *pulVal; /* +0x0000 */ unsigned long long *pullVal; /* +0x0000 */ /* unsigned char pintVal[0]; +0x0000 74 04 00 00 */ /* unsigned char puintVal[0]; +0x0000 75 04 00 00 */ void *pvRecord; /* +0x0000 */ unsigned char pRecInfo[4]; /* +0x0004 16 1c 00 00 */ }; struct tagVARIANT:::::::: { void *pvRecord; /* +0x0000 */ unsigned char pRecInfo[4]; /* +0x0004 16 1c 00 00 */ }; struct _IRP:: { /* unsigned char MasterIrp[0]; +0x0000 c4 11 00 00 */ long IrpCount; /* +0x0000 */ void *SystemBuffer; /* +0x0000 */ }; struct _IRP:::: { /* unsigned char UserApcRoutine[0]; +0x0000 f6 1e 00 00 */ void *IssuingProcess; /* +0x0000 */ void *UserApcContext; /* +0x0004 */ }; struct _IRP:::::: { /* unsigned char UserApcRoutine[0]; +0x0000 f6 1e 00 00 */ void *IssuingProcess; /* +0x0000 */ }; struct _IRP:::::: { /* unsigned char DeviceQueueEntry[0]; +0x0000 d9 11 00 00 */ unsigned char DriverContext[16]; /* +0x0000 da 11 00 00 */ }; struct _IRP:::::::: { unsigned char DriverContext[16]; /* +0x0000 da 11 00 00 */ }; struct _IRP:::::: { unsigned char ListEntry[8]; /* +0x0000 80 10 00 00 */ /* unsigned char CurrentStackLocation[0]; +0x0008 de 11 00 00 */ unsigned long PacketType; /* +0x0008 */ }; struct _IRP:::::::: { /* unsigned char CurrentStackLocation[0]; +0x0000 de 11 00 00 */ unsigned long PacketType; /* +0x0000 */ }; enum tagTYPEKIND { TKIND_ENUM = 0, TKIND_RECORD = 1, TKIND_MODULE = 2, TKIND_INTERFACE = 3, TKIND_DISPATCH = 4, TKIND_COCLASS = 5, TKIND_ALIAS = 6, TKIND_UNION = 7, TKIND_MAX = 8 }; struct tagTYPEATTR { unsigned char guid[16]; /* +0x0000 13 10 00 00 */ unsigned long lcid; /* +0x0010 */ unsigned long dwReserved; /* +0x0014 */ long memidConstructor; /* +0x0018 */ long memidDestructor; /* +0x001c */ unsigned char lpstrSchema[4]; /* +0x0020 71 04 00 00 */ unsigned long cbSizeInstance; /* +0x0024 */ unsigned char typekind[4]; /* +0x0028 04 1f 00 00 */ unsigned short cFuncs; /* +0x002c */ unsigned short cVars; /* +0x002e */ unsigned short cImplTypes; /* +0x0030 */ unsigned short cbSizeVft; /* +0x0032 */ unsigned short cbAlignment; /* +0x0034 */ unsigned short wTypeFlags; /* +0x0036 */ unsigned short wMajorVerNum; /* +0x0038 */ unsigned short wMinorVerNum; /* +0x003a */ unsigned char tdescAlias[8]; /* +0x003c 05 1f 00 00 */ unsigned char idldescType[8]; /* +0x0044 06 1f 00 00 */ }; struct tagCLIPDATA { unsigned long cbSize; /* +0x0000 */ long ulClipFmt; /* +0x0004 */ unsigned char *pClipData; /* +0x0008 */ }; struct threadlocaleinfostruct:: { char *locale; /* +0x0000 */ unsigned char wlocale[4]; /* +0x0004 71 04 00 00 */ unsigned char refcount[4]; /* +0x0008 74 04 00 00 */ unsigned char wrefcount[4]; /* +0x000c 74 04 00 00 */ }; struct _FAST_IO_DISPATCH { unsigned long SizeOfFastIoDispatch; /* +0x0000 */ unsigned char FastIoCheckIfPossible[4]; /* +0x0004 0f 1f 00 00 */ unsigned char FastIoRead[4]; /* +0x0008 12 1f 00 00 */ unsigned char FastIoWrite[4]; /* +0x000c 12 1f 00 00 */ unsigned char FastIoQueryBasicInfo[4]; /* +0x0010 17 1f 00 00 */ unsigned char FastIoQueryStandardInfo[4]; /* +0x0014 1c 1f 00 00 */ unsigned char FastIoLock[4]; /* +0x0018 1f 1f 00 00 */ unsigned char FastIoUnlockSingle[4]; /* +0x001c 22 1f 00 00 */ unsigned char FastIoUnlockAll[4]; /* +0x0020 25 1f 00 00 */ unsigned char FastIoUnlockAllByKey[4]; /* +0x0024 28 1f 00 00 */ unsigned char FastIoDeviceControl[4]; /* +0x0028 2a 1f 00 00 */ unsigned char AcquireFileForNtCreateSection[4]; /* +0x002c 2c 1f 00 00 */ unsigned char ReleaseFileForNtCreateSection[4]; /* +0x0030 2c 1f 00 00 */ unsigned char FastIoDetachDevice[4]; /* +0x0034 2f 1f 00 00 */ unsigned char FastIoQueryNetworkOpenInfo[4]; /* +0x0038 34 1f 00 00 */ unsigned char AcquireForModWrite[4]; /* +0x003c 3a 1f 00 00 */ unsigned char MdlRead[4]; /* +0x0040 3d 1f 00 00 */ unsigned char MdlReadComplete[4]; /* +0x0044 40 1f 00 00 */ unsigned char PrepareMdlWrite[4]; /* +0x0048 3d 1f 00 00 */ unsigned char MdlWriteComplete[4]; /* +0x004c 43 1f 00 00 */ unsigned char FastIoReadCompressed[4]; /* +0x0050 48 1f 00 00 */ unsigned char FastIoWriteCompressed[4]; /* +0x0054 48 1f 00 00 */ unsigned char MdlReadCompleteCompressed[4]; /* +0x0058 40 1f 00 00 */ unsigned char MdlWriteCompleteCompressed[4]; /* +0x005c 43 1f 00 00 */ unsigned char FastIoQueryOpen[4]; /* +0x0060 4b 1f 00 00 */ unsigned char ReleaseForModWrite[4]; /* +0x0064 4e 1f 00 00 */ unsigned char AcquireForCcFlush[4]; /* +0x0068 51 1f 00 00 */ unsigned char ReleaseForCcFlush[4]; /* +0x006c 51 1f 00 00 */ }; struct tagDEC { unsigned short wReserved; /* +0x0000 */ unsigned char scale; /* +0x0002 */ unsigned char sign; /* +0x0003 */ unsigned short signscale; /* +0x0002 */ unsigned long Hi32; /* +0x0004 */ unsigned long Lo32; /* +0x0008 */ unsigned long Mid32; /* +0x000c */ unsigned long long Lo64; /* +0x0008 */ }; struct tagDEC:: { unsigned char scale; /* +0x0000 */ unsigned char sign; /* +0x0001 */ unsigned short signscale; /* +0x0000 */ }; struct tagDEC:::: { unsigned char scale; /* +0x0000 */ unsigned char sign; /* +0x0001 */ }; struct tagDEC:: { unsigned long Lo32; /* +0x0000 */ unsigned long Mid32; /* +0x0004 */ unsigned long long Lo64; /* +0x0000 */ }; struct tagDEC:::: { unsigned long Lo32; /* +0x0000 */ unsigned long Mid32; /* +0x0004 */ }; enum tagSYSKIND { SYS_WIN16 = 0, SYS_WIN32 = 1, SYS_MAC = 2, SYS_WIN64 = 3 }; struct tagTLIBATTR { unsigned char guid[16]; /* +0x0000 13 10 00 00 */ unsigned long lcid; /* +0x0010 */ unsigned char syskind[4]; /* +0x0014 91 1f 00 00 */ unsigned short wMajorVerNum; /* +0x0018 */ unsigned short wMinorVerNum; /* +0x001a */ unsigned short wLibFlags; /* +0x001c */ }; struct tagBSTRBLOB { unsigned long cbSize; /* +0x0000 */ unsigned char *pData; /* +0x0004 */ }; struct $_TypeDescriptor$_extraBytes_79 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[79]; /* +0x0008 97 1f 00 00 */ }; struct _RTL_USER_PROCESS_PARAMETERS { unsigned long MaximumLength; /* +0x0000 */ unsigned long Length; /* +0x0004 */ unsigned long Flags; /* +0x0008 */ unsigned long DebugFlags; /* +0x000c */ void *ConsoleHandle; /* +0x0010 */ unsigned long ConsoleFlags; /* +0x0014 */ void *StandardInput; /* +0x0018 */ void *StandardOutput; /* +0x001c */ void *StandardError; /* +0x0020 */ unsigned char CurrentDirectory[12]; /* +0x0024 9a 1f 00 00 */ unsigned char DllPath[8]; /* +0x0030 a0 10 00 00 */ unsigned char ImagePathName[8]; /* +0x0038 a0 10 00 00 */ unsigned char CommandLine[8]; /* +0x0040 a0 10 00 00 */ void *Environment; /* +0x0048 */ unsigned long StartingX; /* +0x004c */ unsigned long StartingY; /* +0x0050 */ unsigned long CountX; /* +0x0054 */ unsigned long CountY; /* +0x0058 */ unsigned long CountCharsX; /* +0x005c */ unsigned long CountCharsY; /* +0x0060 */ unsigned long FillAttribute; /* +0x0064 */ unsigned long WindowFlags; /* +0x0068 */ unsigned long ShowWindowFlags; /* +0x006c */ unsigned char WindowTitle[8]; /* +0x0070 a0 10 00 00 */ unsigned char DesktopInfo[8]; /* +0x0078 a0 10 00 00 */ unsigned char ShellInfo[8]; /* +0x0080 a0 10 00 00 */ unsigned char RuntimeData[8]; /* +0x0088 a0 10 00 00 */ unsigned char CurrentDirectores[512]; /* +0x0090 9c 1f 00 00 */ unsigned char EnvironmentSize[4]; /* +0x0290 27 10 00 00 */ unsigned char EnvironmentVersion[4]; /* +0x0294 27 10 00 00 */ unsigned char PackageMoniker[8]; /* +0x0298 a0 10 00 00 */ void *PackageDependencyData; /* +0x02a0 */ unsigned long ProcessGroupId; /* +0x02a4 */ }; enum _URLZONEREG { URLZONEREG_DEFAULT = 0, URLZONEREG_HKLM = 1, URLZONEREG_HKCU = 2 }; struct _FILE_BASIC_INFORMATION { unsigned char CreationTime[8]; /* +0x0000 34 10 00 00 */ unsigned char LastAccessTime[8]; /* +0x0008 34 10 00 00 */ unsigned char LastWriteTime[8]; /* +0x0010 34 10 00 00 */ unsigned char ChangeTime[8]; /* +0x0018 34 10 00 00 */ unsigned long FileAttributes; /* +0x0020 */ }; struct $_TypeDescriptor$_extraBytes_27 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[27]; /* +0x0008 a4 1f 00 00 */ }; enum WudfDebuggerType { WudfPlatformUserDebugger = 0, WudfPlatformUserOrKernelDebugger = 1 }; enum tagFUNCKIND { FUNC_VIRTUAL = 0, FUNC_PUREVIRTUAL = 1, FUNC_NONVIRTUAL = 2, FUNC_STATIC = 3, FUNC_DISPATCH = 4 }; struct tagCAUB { unsigned long cElems; /* +0x0000 */ unsigned char *pElems; /* +0x0004 */ }; struct _CLIENT_ID { void *UniqueProcess; /* +0x0000 */ void *UniqueThread; /* +0x0004 */ }; enum VARENUM { VT_EMPTY = 0, VT_NULL = 1, VT_I2 = 2, VT_I4 = 3, VT_R4 = 4, VT_R8 = 5, VT_CY = 6, VT_DATE = 7, VT_BSTR = 8, VT_DISPATCH = 9, VT_ERROR = 10, VT_BOOL = 11, VT_VARIANT = 12, VT_UNKNOWN = 13, VT_DECIMAL = 14, VT_I1 = 16, VT_UI1 = 17, VT_UI2 = 18, VT_UI4 = 19, VT_I8 = 20, VT_UI8 = 21, VT_INT = 22, VT_UINT = 23, VT_VOID = 24, VT_HRESULT = 25, VT_PTR = 26, VT_SAFEARRAY = 27, VT_CARRAY = 28, VT_USERDEFINED = 29, VT_LPSTR = 30, VT_LPWSTR = 31, VT_RECORD = 36, VT_INT_PTR = 37, VT_UINT_PTR = 38, VT_FILETIME = 64, VT_BLOB = 65, VT_STREAM = 66, VT_STORAGE = 67, VT_STREAMED_OBJECT = 68, VT_STORED_OBJECT = 69, VT_BLOB_OBJECT = 70, VT_CF = 71, VT_CLSID = 72, VT_VERSIONED_STREAM = 73, VT_BSTR_BLOB = 4095, VT_VECTOR = 4096, VT_ARRAY = 8192, VT_BYREF = 16384, = 32770 }; struct _IO_SECURITY_CONTEXT { unsigned char SecurityQos[4]; /* +0x0000 ec 15 00 00 */ unsigned char AccessState[4]; /* +0x0004 27 12 00 00 */ unsigned long DesiredAccess; /* +0x0008 */ unsigned long FullCreateOptions; /* +0x000c */ }; struct _PEB_LDR_DATA { unsigned long Length; /* +0x0000 */ unsigned char Initialized; /* +0x0004 */ void *SsHandle; /* +0x0008 */ unsigned char InLoadOrderModuleList[8]; /* +0x000c 80 10 00 00 */ unsigned char InMemoryOrderModuleList[8]; /* +0x0014 80 10 00 00 */ unsigned char InInitializationOrderModuleList[8]; /* +0x001c 80 10 00 00 */ void *EntryInProgress; /* +0x0024 */ unsigned char ShutdownInProgress; /* +0x0028 */ void *ShutdownThreadId; /* +0x002c */ }; struct _ULARGE_INTEGER:: { unsigned long LowPart; /* +0x0000 */ unsigned long HighPart; /* +0x0004 */ }; struct _D3COLD_SUPPORT_INTERFACE { unsigned short Size; /* +0x0000 */ unsigned short Version; /* +0x0002 */ void *Context; /* +0x0004 */ unsigned char InterfaceReference[4]; /* +0x0008 6f 11 00 00 */ unsigned char InterfaceDereference[4]; /* +0x000c 6f 11 00 00 */ unsigned char SetD3ColdSupport[4]; /* +0x0010 bc 1f 00 00 */ unsigned char GetIdleWakeInfo[4]; /* +0x0014 c0 1f 00 00 */ }; enum ReplacesCorHdrNumericDefines { COMIMAGE_FLAGS_ILONLY = 1, COMIMAGE_FLAGS_32BITREQUIRED = 2, COMIMAGE_FLAGS_IL_LIBRARY = 4, COMIMAGE_FLAGS_STRONGNAMESIGNED = 8, COMIMAGE_FLAGS_NATIVE_ENTRYPOINT = 16, /* COMIMAGE_FLAGS_TRACKDEBUGDATA = Unavail */ }; struct $_TypeDescriptor$_extraBytes_26 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[26]; /* +0x0008 c6 1f 00 00 */ }; struct _RTL_BALANCED_NODE:: { /* unsigned char Children[0]; +0x0000 05 11 00 00 */ unsigned char Left[4]; /* +0x0000 04 11 00 00 */ unsigned char Right[4]; /* +0x0004 04 11 00 00 */ }; struct _RTL_BALANCED_NODE:::: { unsigned char Left[4]; /* +0x0000 04 11 00 00 */ unsigned char Right[4]; /* +0x0004 04 11 00 00 */ }; struct _RTL_BALANCED_NODE:: { /* unsigned char Red[0]; +0x0000 06 11 00 00 */ /* unsigned char Balance[0]; +0x0000 35 10 00 00 */ unsigned long ParentValue; /* +0x0000 */ }; struct $_TypeDescriptor$_extraBytes_30 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[30]; /* +0x0008 d1 1f 00 00 */ }; struct _RD_USB_SS_WORKITEM_CONTEXT { unsigned char RdUsbSS[4]; /* +0x0000 f4 18 00 00 */ unsigned char Irp[4]; /* +0x0004 c4 11 00 00 */ }; struct _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS:: { /* unsigned char FRUId[0]; +0x0000 06 11 00 00 */ /* unsigned char FRUText[0]; +0x0000 1d 1b 00 00 */ unsigned char Reserved[1]; /* +0x0000 66 1e 00 00 */ }; enum tagURLZONE { URLZONE_INVALID = -1, URLZONE_PREDEFINED_MIN = 0, URLZONE_LOCAL_MACHINE = 0, URLZONE_INTRANET = 1, URLZONE_TRUSTED = 2, URLZONE_INTERNET = 3, URLZONE_UNTRUSTED = 4, URLZONE_PREDEFINED_MAX = 999, URLZONE_USER_MIN = 1000, URLZONE_USER_MAX = 10000 }; struct _MAILSLOT_CREATE_PARAMETERS { unsigned long MailslotQuota; /* +0x0000 */ unsigned long MaximumMessageSize; /* +0x0004 */ unsigned char ReadTimeout[8]; /* +0x0008 34 10 00 00 */ unsigned char TimeoutSpecified; /* +0x0010 */ }; struct tagSAFEARRAYBOUND { unsigned long cElements; /* +0x0000 */ long lLbound; /* +0x0004 */ }; struct _KAPC_STATE { unsigned char ApcListHead[16]; /* +0x0000 de 1f 00 00 */ unsigned char Process[4]; /* +0x0010 35 12 00 00 */ unsigned char KernelApcInProgress; /* +0x0014 */ unsigned char KernelApcPending; /* +0x0015 */ unsigned char UserApcPending; /* +0x0016 */ }; struct tagIDLDESC { unsigned long dwReserved; /* +0x0000 */ unsigned short wIDLFlags; /* +0x0004 */ }; struct _NAMED_PIPE_CREATE_PARAMETERS { unsigned long NamedPipeType; /* +0x0000 */ unsigned long ReadMode; /* +0x0004 */ unsigned long CompletionMode; /* +0x0008 */ unsigned long MaximumInstances; /* +0x000c */ unsigned long InboundQuota; /* +0x0010 */ unsigned long OutboundQuota; /* +0x0014 */ unsigned char DefaultTimeout[8]; /* +0x0018 34 10 00 00 */ unsigned char TimeoutSpecified; /* +0x0020 */ }; struct $_TypeDescriptor$_extraBytes_18 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[18]; /* +0x0008 e6 1f 00 00 */ }; struct _ACTIVATION_CONTEXT_STACK { unsigned char ActiveFrame[4]; /* +0x0000 fa 1f 00 00 */ unsigned char FrameListCache[8]; /* +0x0004 80 10 00 00 */ unsigned long Flags; /* +0x000c */ unsigned long NextCookieSequenceNumber; /* +0x0010 */ unsigned long StackId; /* +0x0014 */ }; struct _RTL_DRIVE_LETTER_CURDIR { unsigned short Flags; /* +0x0000 */ unsigned short Length; /* +0x0002 */ unsigned long TimeStamp; /* +0x0004 */ unsigned char DosPath[8]; /* +0x0008 e7 10 00 00 */ }; struct $_TypeDescriptor$_extraBytes_61 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[61]; /* +0x0008 00 20 00 00 */ }; struct tagTYPEDESC { /* unsigned char lptdesc[0]; +0x0000 03 20 00 00 */ /* unsigned char lpadesc[0]; +0x0000 05 20 00 00 */ unsigned long hreftype; /* +0x0000 */ unsigned short vt; /* +0x0004 */ }; struct tagTYPEDESC:: { /* unsigned char lptdesc[0]; +0x0000 03 20 00 00 */ /* unsigned char lpadesc[0]; +0x0000 05 20 00 00 */ unsigned long hreftype; /* +0x0000 */ }; struct _WNODE_HEADER:: { unsigned long long HistoricalContext; /* +0x0000 */ unsigned long Version; /* +0x0000 */ unsigned long Linkage; /* +0x0004 */ }; struct _WNODE_HEADER:::: { unsigned long Version; /* +0x0000 */ unsigned long Linkage; /* +0x0004 */ }; struct _WNODE_HEADER:: { unsigned long CountLost; /* +0x0000 */ void *KernelHandle; /* +0x0000 */ unsigned char TimeStamp[8]; /* +0x0000 34 10 00 00 */ }; struct _EX_PUSH_LOCK:::: { /* unsigned char Locked[0]; +0x0000 3b 10 00 00 */ /* unsigned char Waiting[0]; +0x0000 3c 10 00 00 */ /* unsigned char Waking[0]; +0x0000 3d 10 00 00 */ /* unsigned char MultipleShared[0]; +0x0000 3e 10 00 00 */ unsigned char Shared[4]; /* +0x0000 af 11 00 00 */ }; enum tagTYSPEC { TYSPEC_CLSID = 0, TYSPEC_FILEEXT = 1, TYSPEC_MIMETYPE = 2, TYSPEC_FILENAME = 3, TYSPEC_PROGID = 4, TYSPEC_PACKAGENAME = 5, TYSPEC_OBJECTID = 6 }; enum RdWmiGuidListIndexEnum { GuidListIndexForS0Idle = 0, GuidListIndexForSxWake = 1 }; struct _DEVOBJ_EXTENSION { short Type; /* +0x0000 */ unsigned short Size; /* +0x0002 */ unsigned char DeviceObject[4]; /* +0x0004 ca 11 00 00 */ unsigned long PowerFlags; /* +0x0008 */ unsigned char Dope[4]; /* +0x000c 18 20 00 00 */ unsigned long ExtensionFlags; /* +0x0010 */ void *DeviceNode; /* +0x0014 */ unsigned char AttachedTo[4]; /* +0x0018 ca 11 00 00 */ long StartIoCount; /* +0x001c */ long StartIoKey; /* +0x0020 */ unsigned long StartIoFlags; /* +0x0024 */ unsigned char Vpb[4]; /* +0x0028 f8 11 00 00 */ unsigned char DependentList[8]; /* +0x002c 80 10 00 00 */ unsigned char ProviderList[8]; /* +0x0034 80 10 00 00 */ }; struct _FLOATING_SAVE_AREA { unsigned long ControlWord; /* +0x0000 */ unsigned long StatusWord; /* +0x0004 */ unsigned long TagWord; /* +0x0008 */ unsigned long ErrorOffset; /* +0x000c */ unsigned long ErrorSelector; /* +0x0010 */ unsigned long DataOffset; /* +0x0014 */ unsigned long DataSelector; /* +0x0018 */ unsigned char RegisterArea[80]; /* +0x001c 1b 20 00 00 */ unsigned long Cr0NpxState; /* +0x006c */ }; struct { /* unsigned char typeInfo_RdDriver[0]; +0x0000 92 15 00 00 */ /* unsigned char typeInfo_RdFdoDevice[0]; +0x0000 80 14 00 00 */ /* unsigned char typeInfo_RdCtrlDevice[0]; +0x0000 e5 18 00 00 */ /* unsigned char typeInfo_RdProcess[0]; +0x0000 3a 16 00 00 */ /* unsigned char typeInfo_RdDrvMgrCtrlDevice[0]; +0x0000 22 16 00 00 */ /* unsigned char typeInfo_RdFdoDeviceParameters[0]; +0x0000 3d 19 00 00 */ /* unsigned char typeInfo_RdCtrlDeviceParameters[0]; +0x0000 7c 17 00 00 */ unsigned char typeInfo_RdProcessParameters[4]; /* +0x0000 c4 15 00 00 */ }; struct _TXN_PARAMETER_BLOCK { unsigned short Length; /* +0x0000 */ unsigned short TxFsContext; /* +0x0002 */ void *TransactionObject; /* +0x0004 */ }; enum tagCOINITBASE { COINITBASE_MULTITHREADED = 0 }; struct _KPRCB:: { unsigned short CpuStep; /* +0x0000 */ unsigned char CpuStepping; /* +0x0000 */ unsigned char CpuModel; /* +0x0001 */ }; struct _KPRCB:::: { unsigned char CpuStepping; /* +0x0000 */ unsigned char CpuModel; /* +0x0001 */ }; enum tagDESCKIND { DESCKIND_NONE = 0, DESCKIND_FUNCDESC = 1, DESCKIND_VARDESC = 2, DESCKIND_TYPECOMP = 3, DESCKIND_IMPLICITAPPOBJ = 4, DESCKIND_MAX = 5 }; struct tagCY { unsigned long Lo; /* +0x0000 */ long Hi; /* +0x0004 */ long long int64; /* +0x0000 */ }; struct tagCY:: { unsigned long Lo; /* +0x0000 */ long Hi; /* +0x0004 */ }; enum _PS_WAKE_REASON { PsWakeReasonUser = 0, PsWakeReasonDevice = 1, PsWakeReasonKernel = 2, PsWakeReasonPower = 3, PsMaxWakeReasons = 4 }; enum _tagQUERYOPTION { QUERY_EXPIRATION_DATE = 1, QUERY_TIME_OF_LAST_CHANGE = 2, QUERY_CONTENT_ENCODING = 3, QUERY_CONTENT_TYPE = 4, QUERY_REFRESH = 5, QUERY_RECOMBINE = 6, QUERY_CAN_NAVIGATE = 7, QUERY_USES_NETWORK = 8, QUERY_IS_CACHED = 9, QUERY_IS_INSTALLEDENTRY = 10, QUERY_IS_CACHED_OR_MAPPED = 11, QUERY_USES_CACHE = 12, QUERY_IS_SECURE = 13, QUERY_IS_SAFE = 14, QUERY_USES_HISTORYFOLDER = 15, QUERY_IS_CACHED_AND_USABLE_OFFLINE = 16 }; struct $_s__RTTIBaseClassArray$_extraBytes_8 { unsigned char arrayOfBaseClassDescriptors[9]; /* +0x0000 46 20 00 00 */ }; enum __MIDL_IUri_0001 { Uri_PROPERTY_ABSOLUTE_URI = 0, Uri_PROPERTY_STRING_START = 0, Uri_PROPERTY_AUTHORITY = 1, Uri_PROPERTY_DISPLAY_URI = 2, Uri_PROPERTY_DOMAIN = 3, Uri_PROPERTY_EXTENSION = 4, Uri_PROPERTY_FRAGMENT = 5, Uri_PROPERTY_HOST = 6, Uri_PROPERTY_PASSWORD = 7, Uri_PROPERTY_PATH = 8, Uri_PROPERTY_PATH_AND_QUERY = 9, Uri_PROPERTY_QUERY = 10, Uri_PROPERTY_RAW_URI = 11, Uri_PROPERTY_SCHEME_NAME = 12, Uri_PROPERTY_USER_INFO = 13, Uri_PROPERTY_USER_NAME = 14, Uri_PROPERTY_STRING_LAST = 14, Uri_PROPERTY_HOST_TYPE = 15, Uri_PROPERTY_DWORD_START = 15, Uri_PROPERTY_PORT = 16, Uri_PROPERTY_SCHEME = 17, Uri_PROPERTY_ZONE = 18, Uri_PROPERTY_DWORD_LAST = 18 }; struct _CLOSE_DEVICE_STACK_WORK_ITEM { unsigned char Device[4]; /* +0x0000 80 14 00 00 */ unsigned char CloseDeviceStackMsg[4]; /* +0x0004 a0 14 00 00 */ unsigned char WorkItem[4]; /* +0x0008 6b 15 00 00 */ }; struct _WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS:: { /* unsigned char Primary[0]; +0x0000 3b 10 00 00 */ /* unsigned char ContainmentWarning[0]; +0x0000 3c 10 00 00 */ /* unsigned char Reset[0]; +0x0000 3d 10 00 00 */ /* unsigned char ThresholdExceeded[0]; +0x0000 3e 10 00 00 */ /* unsigned char ResourceNotAvailable[0]; +0x0000 3f 10 00 00 */ /* unsigned char LatentError[0]; +0x0000 40 10 00 00 */ unsigned char Reserved[4]; /* +0x0000 6a 1b 00 00 */ }; struct $_TypeDescriptor$_extraBytes_34 { unsigned char pVFTable[4]; /* +0x0000 01 10 00 00 */ void *spare; /* +0x0004 */ unsigned char name[34]; /* +0x0008 50 20 00 00 */ }; enum tagBINDSTRING { BINDSTRING_HEADERS = 1, BINDSTRING_ACCEPT_MIMES = 2, BINDSTRING_EXTRA_URL = 3, BINDSTRING_LANGUAGE = 4, BINDSTRING_USERNAME = 5, BINDSTRING_PASSWORD = 6, BINDSTRING_UA_PIXELS = 7, BINDSTRING_UA_COLOR = 8, BINDSTRING_OS = 9, BINDSTRING_USER_AGENT = 10, BINDSTRING_ACCEPT_ENCODINGS = 11, BINDSTRING_POST_COOKIE = 12, BINDSTRING_POST_DATA_MIME = 13, BINDSTRING_URL = 14, BINDSTRING_IID = 15, BINDSTRING_FLAG_BIND_TO_OBJECT = 16, BINDSTRING_PTR_BIND_CONTEXT = 17, BINDSTRING_XDR_ORIGIN = 18, BINDSTRING_DOWNLOADPATH = 19, BINDSTRING_ROOTDOC_URL = 20, BINDSTRING_INITIAL_FILENAME = 21 }; struct _FILE_NETWORK_OPEN_INFORMATION { unsigned char CreationTime[8]; /* +0x0000 34 10 00 00 */ unsigned char LastAccessTime[8]; /* +0x0008 34 10 00 00 */ unsigned char LastWriteTime[8]; /* +0x0010 34 10 00 00 */ unsigned char ChangeTime[8]; /* +0x0018 34 10 00 00 */ unsigned char AllocationSize[8]; /* +0x0020 34 10 00 00 */ unsigned char EndOfFile[8]; /* +0x0028 34 10 00 00 */ unsigned long FileAttributes; /* +0x0030 */ }; enum tagVARKIND { VAR_PERINSTANCE = 0, VAR_STATIC = 1, VAR_CONST = 2, VAR_DISPATCH = 3 }; struct tagVARDESC { long memid; /* +0x0000 */ unsigned char lpstrSchema[4]; /* +0x0004 71 04 00 00 */ unsigned long oInst; /* +0x0008 */ unsigned char lpvarValue[4]; /* +0x0008 04 1c 00 00 */ unsigned char elemdescVar[16]; /* +0x000c 57 20 00 00 */ unsigned short wVarFlags; /* +0x001c */ unsigned char varkind[4]; /* +0x0020 59 20 00 00 */ }; struct tagVARDESC:: { unsigned long oInst; /* +0x0000 */ unsigned char lpvarValue[4]; /* +0x0000 04 1c 00 00 */ }; struct tagARRAYDESC { unsigned char tdescElem[8]; /* +0x0000 05 1f 00 00 */ unsigned short cDims; /* +0x0008 */ unsigned char rgbounds[8]; /* +0x000c 69 1d 00 00 */ }; struct _ACCESS_STATE:: { /* unsigned char InitialPrivilegeSet[0]; +0x0000 60 20 00 00 */ unsigned char PrivilegeSet[44]; /* +0x0000 2e 12 00 00 */ }; struct tagEXCEPINFO { unsigned short wCode; /* +0x0000 */ unsigned short wReserved; /* +0x0002 */ unsigned char bstrSource[4]; /* +0x0004 71 04 00 00 */ unsigned char bstrDescription[4]; /* +0x0008 71 04 00 00 */ unsigned char bstrHelpFile[4]; /* +0x000c 71 04 00 00 */ unsigned long dwHelpContext; /* +0x0010 */ void *pvReserved; /* +0x0014 */ unsigned char pfnDeferredFillIn[4]; /* +0x0018 65 20 00 00 */ long scode; /* +0x001c */ }; enum _SE_SIGNING_LEVEL { SE_SIGNING_LEVEL_UNCHECKED = 0, SE_SIGNING_LEVEL_PROTECTED_PROCESS = 1, SE_SIGNING_LEVEL_UNSIGNED = 2, SE_SIGNING_LEVEL_AUTHENTICODE = 4, SE_SIGNING_LEVEL_DRM_PROTECTED = 5, SE_SIGNING_LEVEL_WINDOWS = 6, SE_SIGNING_LEVEL_WINDOWS_PROTECTED = 7 }; struct _KPROCESSOR_STATE { unsigned char ContextFrame[716]; /* +0x0000 30 1e 00 00 */ unsigned char SpecialRegisters[84]; /* +0x02cc 6a 20 00 00 */ }; enum tagXMLEMEM_TYPE { XMLELEMTYPE_ELEMENT = 0, XMLELEMTYPE_TEXT = 1, XMLELEMTYPE_COMMENT = 2, XMLELEMTYPE_DOCUMENT = 3, XMLELEMTYPE_DTD = 4, XMLELEMTYPE_PI = 5, XMLELEMTYPE_OTHER = 6 }; enum WDF_REGISTRY_READ_RESULT { ValuePresent = 0, ValueNotPresent = 1, ValueInvalid = 2 }; enum _REG_NOTIFY_CLASS { RegNtDeleteKey = 0, RegNtPreDeleteKey = 0, RegNtSetValueKey = 1, RegNtPreSetValueKey = 1, RegNtDeleteValueKey = 2, RegNtPreDeleteValueKey = 2, RegNtSetInformationKey = 3, RegNtPreSetInformationKey = 3, RegNtRenameKey = 4, RegNtPreRenameKey = 4, RegNtEnumerateKey = 5, RegNtPreEnumerateKey = 5, RegNtEnumerateValueKey = 6, RegNtPreEnumerateValueKey = 6, RegNtQueryKey = 7, RegNtPreQueryKey = 7, RegNtQueryValueKey = 8, RegNtPreQueryValueKey = 8, RegNtQueryMultipleValueKey = 9, RegNtPreQueryMultipleValueKey = 9, RegNtPreCreateKey = 10, RegNtPostCreateKey = 11, RegNtPreOpenKey = 12, RegNtPostOpenKey = 13, RegNtKeyHandleClose = 14, RegNtPreKeyHandleClose = 14, RegNtPostDeleteKey = 15, RegNtPostSetValueKey = 16, RegNtPostDeleteValueKey = 17, RegNtPostSetInformationKey = 18, RegNtPostRenameKey = 19, RegNtPostEnumerateKey = 20, RegNtPostEnumerateValueKey = 21, RegNtPostQueryKey = 22, RegNtPostQueryValueKey = 23, RegNtPostQueryMultipleValueKey = 24, RegNtPostKeyHandleClose = 25, RegNtPreCreateKeyEx = 26, RegNtPostCreateKeyEx = 27, RegNtPreOpenKeyEx = 28, RegNtPostOpenKeyEx = 29, RegNtPreFlushKey = 30, RegNtPostFlushKey = 31, RegNtPreLoadKey = 32, RegNtPostLoadKey = 33, RegNtPreUnLoadKey = 34, RegNtPostUnLoadKey = 35, RegNtPreQueryKeySecurity = 36, RegNtPostQueryKeySecurity = 37, RegNtPreSetKeySecurity = 38, RegNtPostSetKeySecurity = 39, RegNtCallbackObjectContextCleanup = 40, RegNtPreRestoreKey = 41, RegNtPostRestoreKey = 42, RegNtPreSaveKey = 43, RegNtPostSaveKey = 44, RegNtPreReplaceKey = 45, RegNtPostReplaceKey = 46, MaxRegNtNotifyClass = 47 }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned long SystemContext; /* +0x0000 */ unsigned char Type[4]; /* +0x0004 54 19 00 00 */ unsigned char State[4]; /* +0x0008 5f 17 00 00 */ unsigned char ShutdownType[4]; /* +0x000c f9 1d 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned char PowerSequence[12]; /* +0x0000 f3 1d 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned char Capabilities[64]; /* +0x0000 d9 1d 00 00 */ }; struct _WUDFMESSAGE_IRP_PARAMETERS:: { unsigned char RawSizeInBytes[4]; /* +0x0000 75 00 00 00 */ unsigned char AllocatedResources[4]; /* +0x0004 b4 17 00 00 */ unsigned char TranslatedSizeInBytes[4]; /* +0x0008 75 00 00 00 */ unsigned char AllocatedResourcesTranslated[4]; /* +0x000c b4 17 00 00 */ }; struct _ERESOURCE { unsigned char SystemResourcesList[8]; /* +0x0000 80 10 00 00 */ unsigned char OwnerTable[4]; /* +0x0008 7e 20 00 00 */ short ActiveCount; /* +0x000c */ unsigned short Flag; /* +0x000e */ unsigned char ReservedLowFlags; /* +0x000e */ unsigned char WaiterPriority; /* +0x000f */ unsigned char SharedWaiters[4]; /* +0x0010 80 20 00 00 */ unsigned char ExclusiveWaiters[4]; /* +0x0014 4e 11 00 00 */ unsigned char OwnerEntry[8]; /* +0x0018 7d 20 00 00 */ unsigned long ActiveEntries; /* +0x0020 */ unsigned long ContentionCount; /* +0x0024 */ unsigned long NumberOfSharedWaiters; /* +0x0028 */ unsigned long NumberOfExclusiveWaiters; /* +0x002c */ void *Address; /* +0x0030 */ unsigned long CreatorBackTraceIndex; /* +0x0030 */ unsigned long SpinLock; /* +0x0034 */ }; struct _ERESOURCE:: { unsigned short Flag; /* +0x0000 */ unsigned char ReservedLowFlags; /* +0x0000 */ unsigned char WaiterPriority; /* +0x0001 */ }; struct _ERESOURCE:::: { unsigned char ReservedLowFlags; /* +0x0000 */ unsigned char WaiterPriority; /* +0x0001 */ }; struct _ERESOURCE:: { void *Address; /* +0x0000 */ unsigned long CreatorBackTraceIndex; /* +0x0000 */ }; struct _KSEMAPHORE { unsigned char Header[16]; /* +0x0000 54 11 00 00 */ long Limit; /* +0x0010 */ }; struct _KAPC:: { unsigned char KernelRoutine[4]; /* +0x0000 50 1b 00 00 */ unsigned char RundownRoutine[4]; /* +0x0004 53 1b 00 00 */ /* unsigned char NormalRoutine[-8]; +0x0008 4c 1b 00 00 */ unsigned char Reserved[12]; /* +0x0000 54 1b 00 00 */ }; struct _KAPC:::: { unsigned char KernelRoutine[4]; /* +0x0000 50 1b 00 00 */ unsigned char RundownRoutine[4]; /* +0x0004 53 1b 00 00 */ unsigned char NormalRoutine[4]; /* +0x0008 4c 1b 00 00 */ }; struct _POWER_SEQUENCE { unsigned long SequenceD1; /* +0x0000 */ unsigned long SequenceD2; /* +0x0004 */ unsigned long SequenceD3; /* +0x0008 */ }; struct _OBJECT_DUMP_CONTROL { void *Stream; /* +0x0000 */ unsigned long Detail; /* +0x0004 */ }; struct _WUDFMESSAGE_CREATE:: { /* unsigned char Header[0]; +0x0000 5e 13 00 00 */ unsigned char IoHeader[24]; /* +0x0000 68 13 00 00 */ }; struct ONE_PAGE_MDL { unsigned char Mdl[28]; /* +0x0000 c5 11 00 00 */ unsigned char PfnArray[4]; /* +0x001c 33 10 00 00 */ }; struct tagFUNCDESC { long memid; /* +0x0000 */ long *lprgscode; /* +0x0004 */ unsigned char lprgelemdescParam[4]; /* +0x0008 97 20 00 00 */ unsigned char funckind[4]; /* +0x000c aa 1f 00 00 */ unsigned char invkind[4]; /* +0x0010 d2 1c 00 00 */ unsigned char callconv[4]; /* +0x0014 41 1b 00 00 */ short cParams; /* +0x0018 */ short cParamsOpt; /* +0x001a */ short oVft; /* +0x001c */ short cScodes; /* +0x001e */ unsigned char elemdescFunc[16]; /* +0x0020 57 20 00 00 */ unsigned short wFuncFlags; /* +0x0030 */ }; struct $_s__RTTIBaseClassArray$_extraBytes_44 { unsigned char arrayOfBaseClassDescriptors[45]; /* +0x0000 9b 20 00 00 */ }; struct _WHEA_PERSISTENCE_INFO { /* unsigned char Signature[0]; +0x0000 9e 20 00 00 */ /* unsigned char Length[0]; +0x0000 9f 20 00 00 */ /* unsigned char Identifier[0]; +0x0000 a0 20 00 00 */ /* unsigned char Attributes[0]; +0x0000 a1 20 00 00 */ /* unsigned char DoNotLog[0]; +0x0000 a2 20 00 00 */ /* unsigned char Reserved[0]; +0x0000 a3 20 00 00 */ unsigned long long AsULONGLONG; /* +0x0000 */ }; struct _WHEA_PERSISTENCE_INFO:: { /* unsigned char Signature[0]; +0x0000 9e 20 00 00 */ /* unsigned char Length[0]; +0x0000 9f 20 00 00 */ /* unsigned char Identifier[0]; +0x0000 a0 20 00 00 */ /* unsigned char Attributes[0]; +0x0000 a1 20 00 00 */ /* unsigned char DoNotLog[0]; +0x0000 a2 20 00 00 */ unsigned char Reserved[8]; /* +0x0000 a3 20 00 00 */ }; enum PIDMSI_STATUS_VALUE { PIDMSI_STATUS_NORMAL = 0, PIDMSI_STATUS_NEW = 1, PIDMSI_STATUS_PRELIM = 2, PIDMSI_STATUS_DRAFT = 3, PIDMSI_STATUS_INPROGRESS = 4, PIDMSI_STATUS_EDIT = 5, PIDMSI_STATUS_REVIEW = 6, PIDMSI_STATUS_PROOF = 7, PIDMSI_STATUS_FINAL = 8, PIDMSI_STATUS_OTHER = 32767 }; enum _KINTERRUPT_POLARITY { InterruptPolarityUnknown = 0, InterruptActiveHigh = 1, InterruptRisingEdge = 1, InterruptActiveLow = 2, InterruptFallingEdge = 2, InterruptActiveBoth = 3 }; enum tagApplicationType { ServerApplication = 0, LibraryApplication = 1 }; struct _RdIrpContext:: { unsigned char MajorFunction; /* +0x0000 */ unsigned char MinorFunction; /* +0x0001 */ unsigned char MessageType[2]; /* +0x0002 a2 16 00 00 */ unsigned char Device[4]; /* +0x0004 80 14 00 00 */ unsigned char Message[4]; /* +0x0008 a0 14 00 00 */ unsigned char CancelWorkItem[4]; /* +0x000c 87 15 00 00 */ /* unsigned char Create[0]; +0x0010 8f 18 00 00 */ /* unsigned char Close[0]; +0x0010 90 18 00 00 */ /* unsigned char Cleanup[0]; +0x0010 91 18 00 00 */ /* unsigned char Io[0]; +0x0010 92 18 00 00 */ unsigned char Pnp[20]; /* +0x0010 93 18 00 00 */ }; struct _RdIrpContext:::::: { unsigned char CreateContext[4]; /* +0x0000 08 19 00 00 */ }; struct _RdIrpContext:::::: { long Status; /* +0x0000 */ }; struct _RdIrpContext:::::: { unsigned long NumberIOsCompleted; /* +0x0000 */ }; struct _RdIrpContext:::::: { unsigned char BufferSize[8]; /* +0x0000 2c 10 00 00 */ unsigned char BufferFlags[2]; /* +0x0008 b8 20 00 00 */ unsigned char InformationStoresBytesCopied[10]; /* +0x000a 30 00 00 00 */ }; struct _RdIrpContext:::::::: { void *Buffer; /* +0x0000 */ unsigned char Mdl[4]; /* +0x0000 c6 11 00 00 */ }; struct _RdIrpContext:::::: { unsigned long NumberIOsCompleted; /* +0x0000 */ unsigned char Tracker[4]; /* +0x0004 c0 18 00 00 */ unsigned char Completion[4]; /* +0x0008 30 00 00 00 */ }; struct _EXCEPTION_RECORD { long ExceptionCode; /* +0x0000 */ unsigned long ExceptionFlags; /* +0x0004 */ unsigned char ExceptionRecord[4]; /* +0x0008 2f 1e 00 00 */ void *ExceptionAddress; /* +0x000c */ unsigned long NumberParameters; /* +0x0010 */ unsigned char ExceptionInformation[60]; /* +0x0014 c1 20 00 00 */ }; struct _SYSTEM_POWER_STATE_CONTEXT { /* unsigned char Reserved1[0]; +0x0000 c4 20 00 00 */ /* unsigned char TargetSystemState[0]; +0x0000 c5 20 00 00 */ /* unsigned char EffectiveSystemState[0]; +0x0000 c6 20 00 00 */ /* unsigned char CurrentSystemState[0]; +0x0000 c7 20 00 00 */ /* unsigned char IgnoreHibernationPath[0]; +0x0000 c8 20 00 00 */ /* unsigned char PseudoTransition[0]; +0x0000 c9 20 00 00 */ /* unsigned char Reserved2[0]; +0x0000 ca 20 00 00 */ unsigned long ContextAsUlong; /* +0x0000 */ }; struct _SYSTEM_POWER_STATE_CONTEXT:::: { /* unsigned char Reserved1[0]; +0x0000 c4 20 00 00 */ /* unsigned char TargetSystemState[0]; +0x0000 c5 20 00 00 */ /* unsigned char EffectiveSystemState[0]; +0x0000 c6 20 00 00 */ /* unsigned char CurrentSystemState[0]; +0x0000 c7 20 00 00 */ /* unsigned char IgnoreHibernationPath[0]; +0x0000 c8 20 00 00 */ /* unsigned char PseudoTransition[0]; +0x0000 c9 20 00 00 */ unsigned char Reserved2[4]; /* +0x0000 ca 20 00 00 */ }; struct _COMPRESSED_DATA_INFO { unsigned short CompressionFormatAndEngine; /* +0x0000 */ unsigned char CompressionUnitShift; /* +0x0002 */ unsigned char ChunkShift; /* +0x0003 */ unsigned char ClusterShift; /* +0x0004 */ unsigned char Reserved; /* +0x0005 */ unsigned short NumberOfChunks; /* +0x0006 */ unsigned char CompressedChunkSizes[4]; /* +0x0008 33 10 00 00 */ }; struct _INITIAL_PRIVILEGE_SET { unsigned long PrivilegeCount; /* +0x0000 */ unsigned long Control; /* +0x0004 */ unsigned char Privilege[36]; /* +0x0008 d2 20 00 00 */ }; struct _OBJECT_NAME_INFORMATION { unsigned char Name[8]; /* +0x0000 a0 10 00 00 */ }; struct _FILE_STANDARD_INFORMATION { unsigned char AllocationSize[8]; /* +0x0000 34 10 00 00 */ unsigned char EndOfFile[8]; /* +0x0008 34 10 00 00 */ unsigned long NumberOfLinks; /* +0x0010 */ unsigned char DeletePending; /* +0x0014 */ unsigned char Directory; /* +0x0015 */ }; struct tagELEMDESC { unsigned char tdesc[8]; /* +0x0000 05 1f 00 00 */ /* unsigned char idldesc[0]; +0x0008 06 1f 00 00 */ unsigned char paramdesc[8]; /* +0x0008 d9 20 00 00 */ }; struct tagELEMDESC:: { /* unsigned char idldesc[0]; +0x0000 06 1f 00 00 */ unsigned char paramdesc[8]; /* +0x0000 d9 20 00 00 */ }; struct _IMAGE_DATA_DIRECTORY { unsigned long VirtualAddress; /* +0x0000 */ unsigned long Size; /* +0x0004 */ }; struct _CURDIR { unsigned char DosPath[8]; /* +0x0000 a0 10 00 00 */ void *Handle; /* +0x0008 */ }; struct _OWNER_ENTRY { unsigned long OwnerThread; /* +0x0000 */ /* unsigned char IoPriorityBoosted[0]; +0x0004 3b 10 00 00 */ /* unsigned char OwnerReferenced[0]; +0x0004 3c 10 00 00 */ /* unsigned char OwnerCount[0]; +0x0004 78 10 00 00 */ unsigned long TableSize; /* +0x0004 */ }; struct _DEVICE_CAPABILITIES { unsigned short Size; /* +0x0000 */ unsigned short Version; /* +0x0002 */ /* unsigned char DeviceD1[0]; +0x0004 3b 10 00 00 */ /* unsigned char DeviceD2[0]; +0x0004 3c 10 00 00 */ /* unsigned char LockSupported[0]; +0x0004 3d 10 00 00 */ /* unsigned char EjectSupported[0]; +0x0004 3e 10 00 00 */ /* unsigned char Removable[0]; +0x0004 3f 10 00 00 */ /* unsigned char DockDevice[0]; +0x0004 40 10 00 00 */ /* unsigned char UniqueID[0]; +0x0004 41 10 00 00 */ /* unsigned char SilentInstall[0]; +0x0004 e4 20 00 00 */ /* unsigned char RawDeviceOK[0]; +0x0004 e5 20 00 00 */ /* unsigned char SurpriseRemovalOK[0]; +0x0004 e6 20 00 00 */ /* unsigned char WakeFromD0[0]; +0x0004 e7 20 00 00 */ /* unsigned char WakeFromD1[0]; +0x0004 e8 20 00 00 */ /* unsigned char WakeFromD2[0]; +0x0004 e9 20 00 00 */ /* unsigned char WakeFromD3[0]; +0x0004 ea 20 00 00 */ /* unsigned char HardwareDisabled[0]; +0x0004 eb 20 00 00 */ /* unsigned char NonDynamic[0]; +0x0004 ec 20 00 00 */ /* unsigned char WarmEjectSupported[0]; +0x0004 ed 20 00 00 */ /* unsigned char NoDisplayInUI[0]; +0x0004 ee 20 00 00 */ /* unsigned char Reserved1[0]; +0x0004 ef 20 00 00 */ unsigned char Reserved[4]; /* +0x0004 f0 20 00 00 */ unsigned long Address; /* +0x0008 */ unsigned long UINumber; /* +0x000c */ unsigned char DeviceState[28]; /* +0x0010 f1 20 00 00 */ unsigned char SystemWake[4]; /* +0x002c f0 1d 00 00 */ unsigned char DeviceWake[4]; /* +0x0030 15 12 00 00 */ unsigned long D1Latency; /* +0x0034 */ unsigned long D2Latency; /* +0x0038 */ unsigned long D3Latency; /* +0x003c */ }; struct tagPARAMDESC { unsigned char pparamdescex[4]; /* +0x0000 f5 20 00 00 */ unsigned short wParamFlags; /* +0x0004 */ }; struct tagBINDPTR { /* unsigned char lpfuncdesc[0]; +0x0000 bc 1c 00 00 */ /* unsigned char lpvardesc[0]; +0x0000 c1 1c 00 00 */ unsigned char lptcomp[4]; /* +0x0000 b7 1c 00 00 */ }; struct _OWNER_ENTRY:: { /* unsigned char IoPriorityBoosted[0]; +0x0000 3b 10 00 00 */ /* unsigned char OwnerReferenced[0]; +0x0000 3c 10 00 00 */ /* unsigned char OwnerCount[0]; +0x0000 78 10 00 00 */ unsigned long TableSize; /* +0x0000 */ }; struct _OWNER_ENTRY:::: { /* unsigned char IoPriorityBoosted[0]; +0x0000 3b 10 00 00 */ /* unsigned char OwnerReferenced[0]; +0x0000 3c 10 00 00 */ unsigned char OwnerCount[4]; /* +0x0000 78 10 00 00 */ }; struct _KSPECIAL_REGISTERS { unsigned long Cr0; /* +0x0000 */ unsigned long Cr2; /* +0x0004 */ unsigned long Cr3; /* +0x0008 */ unsigned long Cr4; /* +0x000c */ unsigned long KernelDr0; /* +0x0010 */ unsigned long KernelDr1; /* +0x0014 */ unsigned long KernelDr2; /* +0x0018 */ unsigned long KernelDr3; /* +0x001c */ unsigned long KernelDr6; /* +0x0020 */ unsigned long KernelDr7; /* +0x0024 */ unsigned char Gdtr[8]; /* +0x0028 fe 20 00 00 */ unsigned char Idtr[8]; /* +0x0030 fe 20 00 00 */ unsigned short Tr; /* +0x0038 */ unsigned short Ldtr; /* +0x003a */ unsigned long long Xcr0; /* +0x003c */ unsigned char Reserved[16]; /* +0x0044 36 1c 00 00 */ }; struct tagPARAMDESCEX { unsigned long cBytes; /* +0x0000 */ unsigned char varDefaultValue[16]; /* +0x0008 03 1c 00 00 */ }; struct _DESCRIPTOR { unsigned short Pad; /* +0x0000 */ unsigned short Limit; /* +0x0002 */ unsigned long Base; /* +0x0004 */ };