25 CONSTANT(CR4_XMMEXCPT
),
26 CONSTANT(CR4_CHANNELS
),
28 HEADER("KeFeatureBits flags"),
31 CONSTANT(KF_GLOBAL_PAGE
),
32 CONSTANT(KF_LARGE_PAGE
),
33 CONSTANT(KF_CMPXCHG8B
),
34 CONSTANT(KF_FAST_SYSCALL
),
36 HEADER("Machine type definitions"),
37 CONSTANT(MACHINE_TYPE_ISA
),
38 CONSTANT(MACHINE_TYPE_EISA
),
39 CONSTANT(MACHINE_TYPE_MCA
),
42 CONSTANT(EFLAGS_TF_MASK
),
43 CONSTANT(EFLAGS_TF_SHIFT
),
44 CONSTANT(EFLAGS_IF_MASK
),
45 CONSTANT(EFLAGS_IF_SHIFT
),
46 CONSTANT(EFLAGS_ID_MASK
),
48 HEADER("Hypervisor Enlightenment Definitions"),
49 //CONSTANT(HV_MMU_USE_HYPERCALL_FOR_ADDRESS_SWITCH),
50 //CONSTANT(HV_MMU_USE_HYPERCALL_FOR_LOCAL_FLUSH),
51 //CONSTANT(HV_MMU_USE_HYPERCALL_FOR_REMOTE_FLUSH),
52 //CONSTANT(HV_X64_MSR_APIC_EOI),
53 //CONSTANT(HV_APIC_ENLIGHTENED),
54 //CONSTANT(HV_KE_USE_HYPERCALL_FOR_LONG_SPIN_WAIT),
55 //CONSTANT(HV_VIRTUAL_APIC_NO_EOI_REQUIRED_V),
56 //CONSTANT(HvApicFlags),
58 HEADER("KDGT selectors"),
59 CONSTANT(KGDT64_NULL
),
60 CONSTANT(KGDT64_R0_CODE
),
61 CONSTANT(KGDT64_R0_DATA
),
62 CONSTANT(KGDT64_R3_CMCODE
),
63 CONSTANT(KGDT64_R3_DATA
),
64 CONSTANT(KGDT64_R3_CODE
),
65 CONSTANT(KGDT64_SYS_TSS
),
66 CONSTANT(KGDT64_R3_CMTEB
),
68 HEADER("Machine Specific Register Numbers"),
73 CONSTANT(MSR_SYSCALL_MASK
),
74 CONSTANT(MSR_FS_BASE
),
75 CONSTANT(MSR_GS_BASE
),
76 CONSTANT(MSR_GS_SWAP
),
77 CONSTANT(MSR_MCG_STATUS
),
78 CONSTANT(MSR_AMD_ACCESS
),
80 HEADER("Flags for MSR_EFER"),
86 CONSTANT(MSR_DEGUG_CTL
),
87 CONSTANT(MSR_LAST_BRANCH_FROM
),
88 CONSTANT(MSR_LAST_BRANCH_TO
),
89 CONSTANT(MSR_LAST_EXCEPTION_FROM
),
90 CONSTANT(MSR_LAST_EXCEPTION_TO
),
92 HEADER("Flags for MSR_DEGUG_CTL"),
93 //CONSTANT(MSR_DEBUG_CTL_LBR),
94 //CONSTANT(MSR_DEBUG_CRL_BTF),
96 HEADER("Fatal exception codes"),
97 CONSTANT(EXCEPTION_DIVIDED_BY_ZERO
),
98 CONSTANT(EXCEPTION_DEBUG
),
99 CONSTANT(EXCEPTION_NMI
),
100 CONSTANT(EXCEPTION_INT3
),
101 CONSTANT(EXCEPTION_BOUND_CHECK
),
102 CONSTANT(EXCEPTION_INVALID_OPCODE
),
103 CONSTANT(EXCEPTION_NPX_NOT_AVAILABLE
),
104 CONSTANT(EXCEPTION_DOUBLE_FAULT
),
105 CONSTANT(EXCEPTION_NPX_OVERRUN
),
106 CONSTANT(EXCEPTION_INVALID_TSS
),
107 CONSTANT(EXCEPTION_SEGMENT_NOT_PRESENT
),
108 CONSTANT(EXCEPTION_STACK_FAULT
),
109 CONSTANT(EXCEPTION_GP_FAULT
),
110 CONSTANT(EXCEPTION_RESERVED_TRAP
),
111 CONSTANT(EXCEPTION_NPX_ERROR
),
112 CONSTANT(EXCEPTION_ALIGNMENT_CHECK
),
114 HEADER("Argument Home Address"),
121 OFFSET(CONTEXT_P1Home
, CONTEXT
, P1Home
),
122 OFFSET(CONTEXT_P2Home
, CONTEXT
, P2Home
),
123 OFFSET(CONTEXT_P3Home
, CONTEXT
, P3Home
),
124 OFFSET(CONTEXT_P4Home
, CONTEXT
, P4Home
),
125 OFFSET(CONTEXT_P5Home
, CONTEXT
, P5Home
),
126 OFFSET(CONTEXT_P6Home
, CONTEXT
, P6Home
),
127 OFFSET(CONTEXT_ContextFlags
, CONTEXT
, ContextFlags
),
128 OFFSET(CONTEXT_MxCsr
, CONTEXT
, MxCsr
),
129 OFFSET(CONTEXT_SegCs
, CONTEXT
, SegCs
),
130 OFFSET(CONTEXT_SegDs
, CONTEXT
, SegDs
),
131 OFFSET(CONTEXT_SegEs
, CONTEXT
, SegEs
),
132 OFFSET(CONTEXT_SegFs
, CONTEXT
, SegFs
),
133 OFFSET(CONTEXT_SegGs
, CONTEXT
, SegGs
),
134 OFFSET(CONTEXT_SegSs
, CONTEXT
, SegSs
),
135 OFFSET(CONTEXT_EFlags
, CONTEXT
, EFlags
),
136 OFFSET(CONTEXT_Dr0
, CONTEXT
, Dr0
),
137 OFFSET(CONTEXT_Dr1
, CONTEXT
, Dr1
),
138 OFFSET(CONTEXT_Dr2
, CONTEXT
, Dr2
),
139 OFFSET(CONTEXT_Dr3
, CONTEXT
, Dr3
),
140 OFFSET(CONTEXT_Dr6
, CONTEXT
, Dr6
),
141 OFFSET(CONTEXT_Dr7
, CONTEXT
, Dr7
),
142 OFFSET(CONTEXT_Rax
, CONTEXT
, Rax
),
143 OFFSET(CONTEXT_Rcx
, CONTEXT
, Rcx
),
144 OFFSET(CONTEXT_Rdx
, CONTEXT
, Rdx
),
145 OFFSET(CONTEXT_Rbx
, CONTEXT
, Rbx
),
146 OFFSET(CONTEXT_Rsp
, CONTEXT
, Rsp
),
147 OFFSET(CONTEXT_Rbp
, CONTEXT
, Rbp
),
148 OFFSET(CONTEXT_Rsi
, CONTEXT
, Rsi
),
149 OFFSET(CONTEXT_Rdi
, CONTEXT
, Rdi
),
150 OFFSET(CONTEXT_R8
, CONTEXT
, R8
),
151 OFFSET(CONTEXT_R9
, CONTEXT
, R9
),
152 OFFSET(CONTEXT_R10
, CONTEXT
, R10
),
153 OFFSET(CONTEXT_R11
, CONTEXT
, R11
),
154 OFFSET(CONTEXT_R12
, CONTEXT
, R12
),
155 OFFSET(CONTEXT_R13
, CONTEXT
, R13
),
156 OFFSET(CONTEXT_R14
, CONTEXT
, R14
),
157 OFFSET(CONTEXT_R15
, CONTEXT
, R15
),
158 OFFSET(CONTEXT_Rip
, CONTEXT
, Rip
),
159 OFFSET(CONTEXT_FltSave
, CONTEXT
, FltSave
),
160 OFFSET(CONTEXT_Xmm0
, CONTEXT
, Xmm0
),
161 OFFSET(CONTEXT_Xmm1
, CONTEXT
, Xmm1
),
162 OFFSET(CONTEXT_Xmm2
, CONTEXT
, Xmm2
),
163 OFFSET(CONTEXT_Xmm3
, CONTEXT
, Xmm3
),
164 OFFSET(CONTEXT_Xmm4
, CONTEXT
, Xmm4
),
165 OFFSET(CONTEXT_Xmm5
, CONTEXT
, Xmm5
),
166 OFFSET(CONTEXT_Xmm6
, CONTEXT
, Xmm6
),
167 OFFSET(CONTEXT_Xmm7
, CONTEXT
, Xmm7
),
168 OFFSET(CONTEXT_Xmm8
, CONTEXT
, Xmm8
),
169 OFFSET(CONTEXT_Xmm9
, CONTEXT
, Xmm9
),
170 OFFSET(CONTEXT_Xmm10
, CONTEXT
, Xmm10
),
171 OFFSET(CONTEXT_Xmm11
, CONTEXT
, Xmm11
),
172 OFFSET(CONTEXT_Xmm12
, CONTEXT
, Xmm12
),
173 OFFSET(CONTEXT_Xmm13
, CONTEXT
, Xmm13
),
174 OFFSET(CONTEXT_Xmm14
, CONTEXT
, Xmm14
),
175 OFFSET(CONTEXT_Xmm15
, CONTEXT
, Xmm15
),
176 OFFSET(CONTEXT_DebugControl
, CONTEXT
, DebugControl
),
177 OFFSET(CONTEXT_LastBranchToRip
, CONTEXT
, LastBranchToRip
),
178 OFFSET(CONTEXT_LastBranchFromRip
, CONTEXT
, LastBranchFromRip
),
179 OFFSET(CONTEXT_LastExceptionToRip
, CONTEXT
, LastExceptionToRip
),
180 OFFSET(CONTEXT_LastExceptionFromRip
, CONTEXT
, LastExceptionFromRip
),
181 OFFSET(CONTEXT_VectorControl
, CONTEXT
, VectorControl
),
182 OFFSET(CONTEXT_VectorRegister
, CONTEXT
, VectorRegister
),
183 SIZE(CONTEXT_FRAME_LENGTH
, CONTEXT
),
185 HEADER("DISPATCHER_CONTEXT"),
186 OFFSET(DcControlPc
, DISPATCHER_CONTEXT
, ControlPc
),
187 OFFSET(DcImageBase
, DISPATCHER_CONTEXT
, ImageBase
),
188 OFFSET(DcFunctionEntry
, DISPATCHER_CONTEXT
, FunctionEntry
),
189 OFFSET(DcEstablisherFrame
, DISPATCHER_CONTEXT
, EstablisherFrame
),
190 OFFSET(DcTargetIp
, DISPATCHER_CONTEXT
, TargetIp
),
191 OFFSET(DcContextRecord
, DISPATCHER_CONTEXT
, ContextRecord
),
192 OFFSET(DcLanguageHandler
, DISPATCHER_CONTEXT
, LanguageHandler
),
193 OFFSET(DcHandlerData
, DISPATCHER_CONTEXT
, HandlerData
),
194 OFFSET(DcHistoryTable
, DISPATCHER_CONTEXT
, HistoryTable
),
195 OFFSET(DcScopeIndex
, DISPATCHER_CONTEXT
, ScopeIndex
),
197 HEADER("KEXCEPTION_FRAME"),
198 OFFSET(KEXCEPTION_FRAME_P1Home
, KEXCEPTION_FRAME
, P1Home
),
199 OFFSET(KEXCEPTION_FRAME_P2Home
, KEXCEPTION_FRAME
, P2Home
),
200 OFFSET(KEXCEPTION_FRAME_P3Home
, KEXCEPTION_FRAME
, P3Home
),
201 OFFSET(KEXCEPTION_FRAME_P4Home
, KEXCEPTION_FRAME
, P4Home
),
202 OFFSET(KEXCEPTION_FRAME_P5
, KEXCEPTION_FRAME
, P5
),
203 OFFSET(KEXCEPTION_FRAME_Xmm6
, KEXCEPTION_FRAME
, Xmm6
),
204 OFFSET(KEXCEPTION_FRAME_Xmm7
, KEXCEPTION_FRAME
, Xmm7
),
205 OFFSET(KEXCEPTION_FRAME_Xmm8
, KEXCEPTION_FRAME
, Xmm8
),
206 OFFSET(KEXCEPTION_FRAME_Xmm9
, KEXCEPTION_FRAME
, Xmm9
),
207 OFFSET(KEXCEPTION_FRAME_Xmm10
, KEXCEPTION_FRAME
, Xmm10
),
208 OFFSET(KEXCEPTION_FRAME_Xmm11
, KEXCEPTION_FRAME
, Xmm11
),
209 OFFSET(KEXCEPTION_FRAME_Xmm12
, KEXCEPTION_FRAME
, Xmm12
),
210 OFFSET(KEXCEPTION_FRAME_Xmm13
, KEXCEPTION_FRAME
, Xmm13
),
211 OFFSET(KEXCEPTION_FRAME_Xmm14
, KEXCEPTION_FRAME
, Xmm14
),
212 OFFSET(KEXCEPTION_FRAME_Xmm15
, KEXCEPTION_FRAME
, Xmm15
),
213 OFFSET(KEXCEPTION_FRAME_MxCsr
, KEXCEPTION_FRAME
, MxCsr
),
214 OFFSET(KEXCEPTION_FRAME_Rbp
, KEXCEPTION_FRAME
, Rbp
),
215 OFFSET(KEXCEPTION_FRAME_Rbx
, KEXCEPTION_FRAME
, Rbx
),
216 OFFSET(KEXCEPTION_FRAME_Rdi
, KEXCEPTION_FRAME
, Rdi
),
217 OFFSET(KEXCEPTION_FRAME_Rsi
, KEXCEPTION_FRAME
, Rsi
),
218 OFFSET(KEXCEPTION_FRAME_R12
, KEXCEPTION_FRAME
, R12
),
219 OFFSET(KEXCEPTION_FRAME_R13
, KEXCEPTION_FRAME
, R13
),
220 OFFSET(KEXCEPTION_FRAME_R14
, KEXCEPTION_FRAME
, R14
),
221 OFFSET(KEXCEPTION_FRAME_R15
, KEXCEPTION_FRAME
, R15
),
222 OFFSET(KEXCEPTION_FRAME_Return
, KEXCEPTION_FRAME
, Return
),
223 OFFSET(KEXCEPTION_FRAME_InitialStack
, KEXCEPTION_FRAME
, InitialStack
),
224 OFFSET(KEXCEPTION_FRAME_TrapFrame
, KEXCEPTION_FRAME
, TrapFrame
),
225 OFFSET(KEXCEPTION_FRAME_CallbackStack
, KEXCEPTION_FRAME
, CallbackStack
),
226 OFFSET(KEXCEPTION_FRAME_OutputBuffer
, KEXCEPTION_FRAME
, OutputBuffer
),
227 OFFSET(KEXCEPTION_FRAME_OutputLength
, KEXCEPTION_FRAME
, OutputLength
),
228 SIZE(KEXCEPTION_FRAME_LENGTH
, KEXCEPTION_FRAME
),
230 HEADER("JUMP_BUFFER"),
231 OFFSET(JbFrame
, _JUMP_BUFFER
, Frame
),
232 OFFSET(JbRbx
, _JUMP_BUFFER
, Rbx
),
233 OFFSET(JbRsp
, _JUMP_BUFFER
, Rsp
),
234 OFFSET(JbRbp
, _JUMP_BUFFER
, Rbp
),
235 OFFSET(JbRsi
, _JUMP_BUFFER
, Rsi
),
236 OFFSET(JbRdi
, _JUMP_BUFFER
, Rdi
),
237 OFFSET(JbR12
, _JUMP_BUFFER
, R12
),
238 OFFSET(JbR13
, _JUMP_BUFFER
, R13
),
239 OFFSET(JbR14
, _JUMP_BUFFER
, R14
),
240 OFFSET(JbR15
, _JUMP_BUFFER
, R15
),
241 OFFSET(JbRip
, _JUMP_BUFFER
, Rip
),
242 //OFFSET(JbMxCsr, _JUMP_BUFFER, MxCsr), // Spare
243 //OFFSET(JbFpCsr, _JUMP_BUFFER, FpCsr),
244 OFFSET(JbXmm6
, _JUMP_BUFFER
, Xmm6
),
245 OFFSET(JbXmm7
, _JUMP_BUFFER
, Xmm7
),
246 OFFSET(JbXmm8
, _JUMP_BUFFER
, Xmm8
),
247 OFFSET(JbXmm9
, _JUMP_BUFFER
, Xmm9
),
248 OFFSET(JbXmm10
, _JUMP_BUFFER
, Xmm10
),
249 OFFSET(JbXmm11
, _JUMP_BUFFER
, Xmm11
),
250 OFFSET(JbXmm12
, _JUMP_BUFFER
, Xmm12
),
251 OFFSET(JbXmm13
, _JUMP_BUFFER
, Xmm13
),
252 OFFSET(JbXmm14
, _JUMP_BUFFER
, Xmm14
),
253 OFFSET(JbXmm15
, _JUMP_BUFFER
, Xmm15
),
255 HEADER("KGDTENTRY64"),
256 OFFSET(KgdtBaseLow
, KGDTENTRY64
, BaseLow
),
257 OFFSET(KgdtBaseMiddle
, KGDTENTRY64
, Bytes
.BaseMiddle
),
258 OFFSET(KgdtBaseHigh
, KGDTENTRY64
, Bytes
.BaseHigh
),
259 OFFSET(KgdtBaseUpper
, KGDTENTRY64
, BaseUpper
),
260 OFFSET(KgdtLimitHigh
, KGDTENTRY64
, Bytes
.Flags2
),
261 OFFSET(KgdtLimitLow
, KGDTENTRY64
, LimitLow
),
262 //CONSTANT(KGDT_LIMIT_ENCODE_MASK),
265 OFFSET(PbMxCsr
, KPRCB
, MxCsr
),
266 OFFSET(PbNumber
, KPRCB
, Number
),
267 OFFSET(PbInterruptRequest
, KPRCB
, InterruptRequest
),
268 OFFSET(PbIdleHalt
, KPRCB
, IdleHalt
),
269 OFFSET(PbCurrentThread
, KPRCB
, CurrentThread
),
270 OFFSET(PbNextThread
, KPRCB
, NextThread
),
271 OFFSET(PbIdleThread
, KPRCB
, IdleThread
),
272 OFFSET(PbNestingLevel
, KPRCB
, NestingLevel
),
273 OFFSET(PbRspBase
, KPRCB
, RspBase
),
274 OFFSET(PbPrcbLock
, KPRCB
, PrcbLock
),
275 OFFSET(PbSetMember
, KPRCB
, SetMember
),
276 OFFSET(PbProcessorState
, KPRCB
, ProcessorState
),
277 OFFSET(PbCpuType
, KPRCB
, CpuType
),
278 OFFSET(PbCpuID
, KPRCB
, CpuID
),
279 OFFSET(PbCpuStep
, KPRCB
, CpuStep
),
280 OFFSET(PbHalReserved
, KPRCB
, HalReserved
),
281 OFFSET(PbMinorVersion
, KPRCB
, MinorVersion
),
282 OFFSET(PbMajorVersion
, KPRCB
, MajorVersion
),
283 OFFSET(PbBuildType
, KPRCB
, BuildType
),
284 OFFSET(PbCpuVendor
, KPRCB
, CpuVendor
),
285 //OFFSET(PbCoresPerPhysicalProcessor, KPRCB, CoresPerPhysicalProcessor),
286 //OFFSET(PbLogicalProcessorsPerCore, KPRCB, LogicalProcessorsPerCore),
287 OFFSET(PbApicMask
, KPRCB
, ApicMask
),
288 OFFSET(PbCFlushSize
, KPRCB
, CFlushSize
),
289 OFFSET(PbAcpiReserved
, KPRCB
, AcpiReserved
),
290 OFFSET(PbInitialApicId
, KPRCB
, InitialApicId
),
291 //OFFSET(PbStride, KPRCB, Stride),
292 OFFSET(PbLockQueue
, KPRCB
, LockQueue
),
293 OFFSET(PbPPLookasideList
, KPRCB
, PPLookasideList
),
294 OFFSET(PbPPNPagedLookasideList
, KPRCB
, PPNPagedLookasideList
),
295 OFFSET(PbPPPagedLookasideList
, KPRCB
, PPPagedLookasideList
),
296 OFFSET(PbPacketBarrier
, KPRCB
, PacketBarrier
),
297 OFFSET(PbDeferredReadyListHead
, KPRCB
, DeferredReadyListHead
),
298 OFFSET(PbLookasideIrpFloat
, KPRCB
, LookasideIrpFloat
),
299 //OFFSET(PbSystemCalls, KPRCB, SystemCalls),
300 //OFFSET(PbReadOperationCount, KPRCB, ReadOperationCount),
301 //OFFSET(PbWriteOperationCount, KPRCB, WriteOperationCount),
302 //OFFSET(PbOtherOperationCount, KPRCB, OtherOperationCount),
303 //OFFSET(PbReadTransferCount, KPRCB, ReadTransferCount),
304 //OFFSET(PbWriteTransferCount, KPRCB, WriteTransferCount),
305 //OFFSET(PbOtherTransferCount, KPRCB, OtherTransferCount),
306 //OFFSET(PbContextSwitches, KPRCB, ContextSwitches),
307 OFFSET(PbTargetSet
, KPRCB
, TargetSet
),
308 OFFSET(PbIpiFrozen
, KPRCB
, IpiFrozen
),
309 OFFSET(PbRequestMailbox
, KPRCB
, RequestMailbox
),
310 OFFSET(PbSenderSummary
, KPRCB
, SenderSummary
),
311 //OFFSET(PbDpcListHead, KPRCB, DpcListHead),
312 //OFFSET(PbDpcLock, KPRCB, DpcLock),
313 //OFFSET(PbDpcQueueDepth, KPRCB, DpcQueueDepth),
314 //OFFSET(PbDpcCount, KPRCB, DpcCount),
315 OFFSET(PbDpcStack
, KPRCB
, DpcStack
),
316 OFFSET(PbMaximumDpcQueueDepth
, KPRCB
, MaximumDpcQueueDepth
),
317 OFFSET(PbDpcRequestRate
, KPRCB
, DpcRequestRate
),
318 OFFSET(PbMinimumDpcRate
, KPRCB
, MinimumDpcRate
),
319 OFFSET(PbDpcInterruptRequested
, KPRCB
, DpcInterruptRequested
),
320 OFFSET(PbDpcThreadRequested
, KPRCB
, DpcThreadRequested
),
321 OFFSET(PbDpcRoutineActive
, KPRCB
, DpcRoutineActive
),
322 OFFSET(PbDpcThreadActive
, KPRCB
, DpcThreadActive
),
323 OFFSET(PbTimerHand
, KPRCB
, TimerHand
),
324 OFFSET(PbTimerRequest
, KPRCB
, TimerRequest
),
325 OFFSET(PbTickOffset
, KPRCB
, TickOffset
),
326 OFFSET(PbMasterOffset
, KPRCB
, MasterOffset
),
327 OFFSET(PbDpcLastCount
, KPRCB
, DpcLastCount
),
328 OFFSET(PbQuantumEnd
, KPRCB
, QuantumEnd
),
329 OFFSET(PbDpcSetEventRequest
, KPRCB
, DpcSetEventRequest
),
330 OFFSET(PbIdleSchedule
, KPRCB
, IdleSchedule
),
331 OFFSET(PbReadySummary
, KPRCB
, ReadySummary
),
332 OFFSET(PbDispatcherReadyListHead
, KPRCB
, DispatcherReadyListHead
),
333 OFFSET(PbInterruptCount
, KPRCB
, InterruptCount
),
334 OFFSET(PbKernelTime
, KPRCB
, KernelTime
),
335 OFFSET(PbUserTime
, KPRCB
, UserTime
),
336 OFFSET(PbDpcTime
, KPRCB
, DpcTime
),
337 OFFSET(PbInterruptTime
, KPRCB
, InterruptTime
),
338 OFFSET(PbAdjustDpcThreshold
, KPRCB
, AdjustDpcThreshold
),
339 OFFSET(PbSkipTick
, KPRCB
, SkipTick
),
340 OFFSET(PbPollSlot
, KPRCB
, PollSlot
),
341 OFFSET(PbParentNode
, KPRCB
, ParentNode
),
342 OFFSET(PbMultiThreadProcessorSet
, KPRCB
, MultiThreadProcessorSet
),
343 OFFSET(PbMultiThreadSetMaster
, KPRCB
, MultiThreadSetMaster
),
344 //OFFSET(PbStartCycles, KPRCB, StartCycles),
345 OFFSET(PbPageColor
, KPRCB
, PageColor
),
346 OFFSET(PbNodeColor
, KPRCB
, NodeColor
),
347 OFFSET(PbNodeShiftedColor
, KPRCB
,NodeShiftedColor
),
348 OFFSET(PbSecondaryColorMask
, KPRCB
, SecondaryColorMask
),
349 OFFSET(PbSleeping
, KPRCB
, Sleeping
),
350 //OFFSET(PbCycleTime, KPRCB, CycleTime),
351 //OFFSET(PbFastReadNoWait, KPRCB, FastReadNoWait),
352 //OFFSET(PbFastReadWait, KPRCB, FastReadWait),
353 //OFFSET(PbFastReadNotPossible, KPRCB, FastReadNotPossible),
354 //OFFSET(PbCopyReadNoWait, KPRCB, CopyReadNoWait),
355 //OFFSET(PbCopyReadWait, KPRCB, CopyReadWait),
356 //OFFSET(PbCopyReadNoWaitMiss, KPRCB, CopyReadNoWaitMiss),
357 //OFFSET(PbAlignmentFixupCount, KPRCB, AlignmentFixupCount),
358 //OFFSET(PbExceptionDispatchCount, KPRCB, ExceptionDispatchCount),
359 OFFSET(PbVendorString
, KPRCB
, VendorString
),
360 OFFSET(PbPowerState
, KPRCB
, PowerState
),
361 SIZE(ProcessorBlockLength
, KPRCB
),
364 //OFFSET(PcGdt, KPCR, Gdt),
365 //OFFSET(PcTss, KPCR, Tss),
366 OFFSET(PcUserRsp
, KPCR
, UserRsp
),
367 OFFSET(PcSelf
, KPCR
, Self
),
368 OFFSET(PcCurrentPrcb
, KPCR
, CurrentPrcb
),
369 OFFSET(PcLockArray
, KPCR
, LockArray
),
370 //OFFSET(PcTeb, KPCR, Teb),
371 //OFFSET(PcIdt, KPCR, Idt),
372 OFFSET(PcIrql
, KPCR
, Irql
),
373 OFFSET(PcStallScaleFactor
, KPCR
, StallScaleFactor
),
374 OFFSET(PcHalReserved
, KPCR
, HalReserved
),
375 //OFFSET(PcPrcb, KPCR, Prcb),
376 //OFFSET(PcMxCsr, KPCR, MxCsr),
377 //OFFSET(PcNumber, KPCR, Number),
378 //OFFSET(PcInterruptRequest, KPCR, InterruptRequest),
379 //OFFSET(PcIdleHalt, KPCR, IdleHalt),
380 OFFSET(PcCurrentThread
, KIPCR
, Prcb
.CurrentThread
),
381 //OFFSET(PcNextThread, KPCR, NextThread),
382 //OFFSET(PcIdleThread, KPCR, IdleThread),
383 //OFFSET(PcIpiFrozen, KPCR, IpiFrozen),
384 //OFFSET(PcNestingLevel, KPCR, NestingLevel),
385 OFFSET(PcRspBase
, KIPCR
, Prcb
.RspBase
),
386 //OFFSET(PcPrcbLock, KPCR, PrcbLock),
387 OFFSET(PcSetMember
, KIPCR
, Prcb
.SetMember
),
389 OFFSET(PcCr0
, KIPCR
, Prcb
.Cr0
),
390 OFFSET(PcCr2
, KIPCR
, Prcb
.Cr2
),
391 OFFSET(PcCr3
, KIPCR
, Prcb
.Cr3
),
392 OFFSET(PcCr4
, KIPCR
, Prcb
.Cr4
),
393 OFFSET(PcKernelDr0
, KIPCR
, Prcb
.KernelDr0
),
394 OFFSET(PcKernelDr1
, KIPCR
, Prcb
.KernelDr1
),
395 OFFSET(PcKernelDr2
, KIPCR
, Prcb
.KernelDr2
),
396 OFFSET(PcKernelDr3
, KIPCR
, Prcb
.KernelDr3
),
397 OFFSET(PcKernelDr7
, KIPCR
, Prcb
.KernelDr7
),
398 OFFSET(PcGdtrLimit
, KIPCR
, Prcb
.GdtrLimit
),
399 OFFSET(PcGdtrBase
, KIPCR
, Prcb
.GdtrBase
),
400 OFFSET(PcIdtrLimit
, KIPCR
, IdtrLimit
),
401 OFFSET(PcIdtrBase
, KIPCR
, IdtrBase
),
402 OFFSET(PcTr
, KIPCR
, Tr
),
403 OFFSET(PcLdtr
, KIPCR
, Ldtr
),
404 OFFSET(PcDebugControl
, KIPCR
, DebugControl
),
405 OFFSET(PcLastBranchToRip
, KIPCR
, LastBranchToRip
),
406 OFFSET(PcLastBranchFromRip
, KIPCR
, LastBranchFromRip
),
407 OFFSET(PcLastExceptionToRip
, KIPCR
, LastExceptionToRip
),
408 OFFSET(PcLastExceptionFromRip
, KIPCR
, LastExceptionFromRip
),
409 OFFSET(PcCr8
, KIPCR
, Cr8
),
411 OFFSET(PcCpuType
, KIPCR
, Prcb
.CpuType
),
412 OFFSET(PcCpuID
, KIPCR
, Prcb
.CpuID
),
413 OFFSET(PcCpuStep
, KIPCR
, Prcb
.CpuStep
),
414 OFFSET(PcCpuVendor
, KIPCR
, Prcb
.CpuVendor
),
415 OFFSET(PcCFlushSize
, KIPCR
, Prcb
.CFlushSize
),
416 OFFSET(PcDeferredReadyListHead
, KIPCR
, Prcb
.DeferredReadyListHead
),
417 OFFSET(PcSystemCalls
, KIPCR
, Prcb
.KeSystemCalls
),
418 OFFSET(PcDpcRoutineActive
, KIPCR
, Prcb
.DpcRoutineActive
),
419 OFFSET(PcInterruptCount
, KIPCR
, Prcb
.InterruptCount
),
420 OFFSET(PcDebuggerSavedIRQL
, KIPCR
, Prcb
.DebuggerSavedIRQL
),
421 OFFSET(PcTickOffset
, KIPCR
, Prcb
.TickOffset
),
422 OFFSET(PcMasterOffset
, KIPCR
, Prcb
.MasterOffset
),
423 OFFSET(PcSkipTick
, KIPCR
, Prcb
.SkipTick
),
424 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
425 OFFSET(PcVirtualApicAssist
, KIPCR
, Prcb
.VirtualApicAssist
),
426 OFFSET(PcStartCycles
, KIPCR
, Prcb
.StartCycles
),
428 SIZE(ProcessorControlRegisterLength
, KIPCR
),
430 HEADER("KPROCESSOR_STATE"),
431 OFFSET(PsSpecialRegisters
, KPROCESSOR_STATE
, SpecialRegisters
),
432 OFFSET(PsCr0
, KPROCESSOR_STATE
, SpecialRegisters
.Cr0
),
433 OFFSET(PsCr2
, KPROCESSOR_STATE
, SpecialRegisters
.Cr2
),
434 OFFSET(PsCr3
, KPROCESSOR_STATE
, SpecialRegisters
.Cr3
),
435 OFFSET(PsCr4
, KPROCESSOR_STATE
, SpecialRegisters
.Cr4
),
436 OFFSET(PsKernelDr0
, KPROCESSOR_STATE
, SpecialRegisters
.KernelDr0
),
437 OFFSET(PsKernelDr1
, KPROCESSOR_STATE
, SpecialRegisters
.KernelDr1
),
438 OFFSET(PsKernelDr2
, KPROCESSOR_STATE
, SpecialRegisters
.KernelDr2
),
439 OFFSET(PsKernelDr3
, KPROCESSOR_STATE
, SpecialRegisters
.KernelDr3
),
440 OFFSET(PsKernelDr6
, KPROCESSOR_STATE
, SpecialRegisters
.KernelDr6
),
441 OFFSET(PsKernelDr7
, KPROCESSOR_STATE
, SpecialRegisters
.KernelDr7
),
442 OFFSET(PsGdtr
, KPROCESSOR_STATE
, SpecialRegisters
.Gdtr
),
443 OFFSET(PsIdtr
, KPROCESSOR_STATE
, SpecialRegisters
.Idtr
),
444 OFFSET(PsTr
, KPROCESSOR_STATE
, SpecialRegisters
.Tr
),
445 OFFSET(PsLdtr
, KPROCESSOR_STATE
, SpecialRegisters
.Ldtr
),
446 OFFSET(PsMxCsr
, KPROCESSOR_STATE
, SpecialRegisters
.MxCsr
),
447 OFFSET(PsContextFrame
, KPROCESSOR_STATE
, ContextFrame
),
448 OFFSET(PsDebugControl
, KPROCESSOR_STATE
, SpecialRegisters
.DebugControl
),
449 OFFSET(PsLastBranchToRip
, KPROCESSOR_STATE
, SpecialRegisters
.LastBranchToRip
),
450 OFFSET(PsLastBranchFromRip
, KPROCESSOR_STATE
, SpecialRegisters
.LastBranchFromRip
),
451 OFFSET(PsLastExceptionToRip
, KPROCESSOR_STATE
, SpecialRegisters
.LastExceptionToRip
),
452 OFFSET(PsLastExceptionFromRip
, KPROCESSOR_STATE
, SpecialRegisters
.LastExceptionFromRip
),
453 OFFSET(PsCr8
, KPROCESSOR_STATE
, SpecialRegisters
.Cr8
),
454 SIZE(ProcessorStateLength
, KPROCESSOR_STATE
),
456 HEADER("KSTART_FRAME"),
457 OFFSET(SfP1Home
, KSTART_FRAME
, P1Home
),
458 OFFSET(SfP2Home
, KSTART_FRAME
, P2Home
),
459 OFFSET(SfP3Home
, KSTART_FRAME
, P3Home
),
460 OFFSET(SfP4Home
, KSTART_FRAME
, P4Home
),
461 OFFSET(SfReturn
, KSTART_FRAME
, Return
),
462 SIZE(KSTART_FRAME_LENGTH
, KSTART_FRAME
),
464 HEADER("KSPECIAL_REGISTERS"),
465 OFFSET(SrKernelDr0
, KSPECIAL_REGISTERS
, KernelDr0
),
466 OFFSET(SrKernelDr1
, KSPECIAL_REGISTERS
, KernelDr1
),
467 OFFSET(SrKernelDr2
, KSPECIAL_REGISTERS
, KernelDr2
),
468 OFFSET(SrKernelDr3
, KSPECIAL_REGISTERS
, KernelDr3
),
469 OFFSET(SrKernelDr6
, KSPECIAL_REGISTERS
, KernelDr6
),
470 OFFSET(SrKernelDr7
, KSPECIAL_REGISTERS
, KernelDr7
),
471 OFFSET(SrGdtr
, KSPECIAL_REGISTERS
, Gdtr
),
472 OFFSET(SrIdtr
, KSPECIAL_REGISTERS
, Idtr
),
473 OFFSET(SrTr
, KSPECIAL_REGISTERS
, Tr
),
474 OFFSET(SrMxCsr
, KSPECIAL_REGISTERS
, MxCsr
),
475 OFFSET(SrMsrGsBase
, KSPECIAL_REGISTERS
, MsrGsBase
),
476 OFFSET(SrMsrGsSwap
, KSPECIAL_REGISTERS
, MsrGsSwap
),
477 OFFSET(SrMsrStar
, KSPECIAL_REGISTERS
, MsrStar
),
478 OFFSET(SrMsrLStar
, KSPECIAL_REGISTERS
, MsrLStar
),
479 OFFSET(SrMsrCStar
, KSPECIAL_REGISTERS
, MsrCStar
),
480 OFFSET(SrMsrSyscallMask
, KSPECIAL_REGISTERS
, MsrSyscallMask
),
482 HEADER("KSYSTEM_TIME"),
483 OFFSET(StLowTime
, KSYSTEM_TIME
, LowPart
),
484 OFFSET(StHigh1Time
, KSYSTEM_TIME
, High1Time
),
485 OFFSET(StHigh2Time
, KSYSTEM_TIME
, High2Time
),
487 HEADER("KSWITCH_FRAME"),
488 OFFSET(SwP5Home
, KSWITCH_FRAME
, P5Home
),
489 OFFSET(SwApcBypass
, KSWITCH_FRAME
, ApcBypass
),
490 OFFSET(SwRbp
, KSWITCH_FRAME
, Rbp
),
491 OFFSET(SwReturn
, KSWITCH_FRAME
, Return
),
492 SIZE(SwitchFrameLength
, KSWITCH_FRAME
),
493 SIZE(KSWITCH_FRAME_LENGTH
, KSWITCH_FRAME
),
495 HEADER("KTRAP_FRAME"),
496 OFFSET(KTRAP_FRAME_P1Home
, KTRAP_FRAME
, P1Home
),
497 OFFSET(KTRAP_FRAME_P2Home
, KTRAP_FRAME
, P2Home
),
498 OFFSET(KTRAP_FRAME_P3Home
, KTRAP_FRAME
, P3Home
),
499 OFFSET(KTRAP_FRAME_P4Home
, KTRAP_FRAME
, P4Home
),
500 OFFSET(KTRAP_FRAME_P5
, KTRAP_FRAME
, P5
),
501 OFFSET(KTRAP_FRAME_PreviousMode
, KTRAP_FRAME
, PreviousMode
),
502 OFFSET(KTRAP_FRAME_PreviousIrql
, KTRAP_FRAME
, PreviousIrql
),
503 OFFSET(KTRAP_FRAME_FaultIndicator
, KTRAP_FRAME
, FaultIndicator
),
504 OFFSET(KTRAP_FRAME_ExceptionActive
, KTRAP_FRAME
, ExceptionActive
),
505 OFFSET(KTRAP_FRAME_MxCsr
, KTRAP_FRAME
, MxCsr
),
506 OFFSET(KTRAP_FRAME_Rax
, KTRAP_FRAME
, Rax
),
507 OFFSET(KTRAP_FRAME_Rcx
, KTRAP_FRAME
, Rcx
),
508 OFFSET(KTRAP_FRAME_Rdx
, KTRAP_FRAME
, Rdx
),
509 OFFSET(KTRAP_FRAME_R8
, KTRAP_FRAME
, R8
),
510 OFFSET(KTRAP_FRAME_R9
, KTRAP_FRAME
, R9
),
511 OFFSET(KTRAP_FRAME_R10
, KTRAP_FRAME
, R10
),
512 OFFSET(KTRAP_FRAME_R11
, KTRAP_FRAME
, R11
),
513 OFFSET(KTRAP_FRAME_GsBase
, KTRAP_FRAME
, GsBase
),
514 OFFSET(KTRAP_FRAME_GsSwap
, KTRAP_FRAME
,GsSwap
),
515 OFFSET(KTRAP_FRAME_Xmm0
, KTRAP_FRAME
, Xmm0
),
516 OFFSET(KTRAP_FRAME_Xmm1
, KTRAP_FRAME
, Xmm1
),
517 OFFSET(KTRAP_FRAME_Xmm2
, KTRAP_FRAME
, Xmm2
),
518 OFFSET(KTRAP_FRAME_Xmm3
, KTRAP_FRAME
, Xmm3
),
519 OFFSET(KTRAP_FRAME_Xmm4
, KTRAP_FRAME
, Xmm4
),
520 OFFSET(KTRAP_FRAME_Xmm5
, KTRAP_FRAME
, Xmm5
),
521 OFFSET(KTRAP_FRAME_FaultAddress
, KTRAP_FRAME
, FaultAddress
),
522 OFFSET(KTRAP_FRAME_TimeStampCKCL
, KTRAP_FRAME
, TimeStampCKCL
),
523 OFFSET(KTRAP_FRAME_Dr0
, KTRAP_FRAME
, Dr0
),
524 OFFSET(KTRAP_FRAME_Dr1
, KTRAP_FRAME
, Dr1
),
525 OFFSET(KTRAP_FRAME_Dr2
, KTRAP_FRAME
, Dr2
),
526 OFFSET(KTRAP_FRAME_Dr3
, KTRAP_FRAME
, Dr3
),
527 OFFSET(KTRAP_FRAME_Dr6
, KTRAP_FRAME
, Dr6
),
528 OFFSET(KTRAP_FRAME_Dr7
, KTRAP_FRAME
, Dr7
),
529 OFFSET(KTRAP_FRAME_DebugControl
, KTRAP_FRAME
, DebugControl
),
530 OFFSET(KTRAP_FRAME_LastBranchToRip
, KTRAP_FRAME
, LastBranchToRip
),
531 OFFSET(KTRAP_FRAME_LastBranchFromRip
, KTRAP_FRAME
, LastBranchFromRip
),
532 OFFSET(KTRAP_FRAME_LastExceptionToRip
, KTRAP_FRAME
, LastExceptionToRip
),
533 OFFSET(KTRAP_FRAME_LastExceptionFromRip
, KTRAP_FRAME
, LastExceptionFromRip
),
534 OFFSET(KTRAP_FRAME_LastBranchControl
, KTRAP_FRAME
, LastBranchControl
),
535 OFFSET(KTRAP_FRAME_LastBranchMSR
, KTRAP_FRAME
, LastBranchMSR
),
536 OFFSET(KTRAP_FRAME_SegDs
, KTRAP_FRAME
, SegDs
),
537 OFFSET(KTRAP_FRAME_SegEs
, KTRAP_FRAME
, SegEs
),
538 OFFSET(KTRAP_FRAME_SegFs
, KTRAP_FRAME
, SegFs
),
539 OFFSET(KTRAP_FRAME_SegGs
, KTRAP_FRAME
, SegGs
),
540 OFFSET(KTRAP_FRAME_TrapFrame
, KTRAP_FRAME
, TrapFrame
),
541 OFFSET(KTRAP_FRAME_Rbx
, KTRAP_FRAME
, Rbx
),
542 OFFSET(KTRAP_FRAME_Rdi
, KTRAP_FRAME
, Rdi
),
543 OFFSET(KTRAP_FRAME_Rsi
, KTRAP_FRAME
, Rsi
),
544 OFFSET(KTRAP_FRAME_Rbp
, KTRAP_FRAME
, Rbp
),
545 OFFSET(KTRAP_FRAME_ErrorCode
, KTRAP_FRAME
, ErrorCode
),
546 OFFSET(KTRAP_FRAME_TimeStampKlog
, KTRAP_FRAME
, TimeStampKlog
),
547 OFFSET(KTRAP_FRAME_Rip
, KTRAP_FRAME
, Rip
),
548 OFFSET(KTRAP_FRAME_SegCs
, KTRAP_FRAME
, SegCs
),
549 OFFSET(KTRAP_FRAME_Logging
, KTRAP_FRAME
, Logging
),
550 OFFSET(KTRAP_FRAME_EFlags
, KTRAP_FRAME
, EFlags
),
551 OFFSET(KTRAP_FRAME_Rsp
, KTRAP_FRAME
, Rsp
),
552 OFFSET(KTRAP_FRAME_SegSs
, KTRAP_FRAME
, SegSs
),
553 OFFSET(KTRAP_FRAME_CodePatchCycle
, KTRAP_FRAME
, CodePatchCycle
),
554 SIZE(KTRAP_FRAME_LENGTH
, KTRAP_FRAME
),
556 #if (NTDDI_VERSION >= NTDDI_WIN7)
557 HEADER("KTIMER_TABLE"),
558 OFFSET(TtEntry
, KTIMER_TABLE
, TimerEntries
),
559 OFFSET(TtTime
, KTIMER_TABLE_ENTRY
, Time
),
560 SIZE(TIMER_ENTRY_SIZE
, KTIMER_TABLE_ENTRY
),
561 SIZE(TIMER_TABLE_SIZE
, KTIMER_TABLE
),
562 SIZE(KTIMER_TABLE_SIZE
, KTIMER_TABLE
),
566 OFFSET(TssRsp0
, KTSS64
, Rsp0
),
567 OFFSET(TssRsp1
, KTSS64
, Rsp1
),
568 OFFSET(TssRsp2
, KTSS64
, Rsp2
),
569 OFFSET(TssPanicStack
, KTSS64
, Ist
[1]),
570 OFFSET(TssMcaStack
, KTSS64
, Ist
[2]),
571 OFFSET(TssNmiStack
, KTSS64
, Ist
[3]),
572 OFFSET(TssIoMapBase
, KTSS64
, IoMapBase
),
573 SIZE(TssLength
, KTSS64
),
575 HEADER("EXCEPTION_RECORD"),
576 OFFSET(EXCEPTION_RECORD_ExceptionCode
, EXCEPTION_RECORD
, ExceptionCode
),
577 OFFSET(EXCEPTION_RECORD_ExceptionFlags
, EXCEPTION_RECORD
, ExceptionFlags
),
578 OFFSET(EXCEPTION_RECORD_ExceptionRecord
, EXCEPTION_RECORD
, ExceptionRecord
),
579 OFFSET(EXCEPTION_RECORD_ExceptionAddress
, EXCEPTION_RECORD
, ExceptionAddress
),
580 OFFSET(EXCEPTION_RECORD_NumberParameters
, EXCEPTION_RECORD
, NumberParameters
),
581 OFFSET(EXCEPTION_RECORD_ExceptionInformation
, EXCEPTION_RECORD
, ExceptionInformation
),
584 OFFSET(KTHREAD_WAIT_IRQL
, KTHREAD
, WaitIrql
),
585 OFFSET(KTHREAD_TrapFrame
, KTHREAD
, TrapFrame
),
586 OFFSET(KTHREAD_PreviousMode
, KTHREAD
, PreviousMode
),
587 OFFSET(KTHREAD_KernelStack
, KTHREAD
, KernelStack
),
588 OFFSET(KTHREAD_UserApcPending
, KTHREAD
, ApcState
.UserApcPending
),
590 HEADER("KINTERRUPT"),
592 OFFSET(KINTERRUPT_Type
, KINTERRUPT
, Type
),
593 OFFSET(KINTERRUPT_Size
, KINTERRUPT
, Size
),
594 OFFSET(KINTERRUPT_InterruptListEntry
, KINTERRUPT
, InterruptListEntry
),
595 OFFSET(KINTERRUPT_ServiceRoutine
, KINTERRUPT
, ServiceRoutine
),
596 OFFSET(KINTERRUPT_ServiceContext
, KINTERRUPT
, ServiceContext
),
597 OFFSET(KINTERRUPT_SpinLock
, KINTERRUPT
, SpinLock
),
598 OFFSET(KINTERRUPT_TickCount
, KINTERRUPT
, TickCount
),
599 OFFSET(KINTERRUPT_ActualLock
, KINTERRUPT
, ActualLock
),
600 OFFSET(KINTERRUPT_DispatchAddress
, KINTERRUPT
, DispatchAddress
),
601 OFFSET(KINTERRUPT_Vector
, KINTERRUPT
, Vector
),
602 OFFSET(KINTERRUPT_Irql
, KINTERRUPT
, Irql
),
603 OFFSET(KINTERRUPT_SynchronizeIrql
, KINTERRUPT
, SynchronizeIrql
),
604 OFFSET(KINTERRUPT_FloatingSave
, KINTERRUPT
, FloatingSave
),
605 OFFSET(KINTERRUPT_Connected
, KINTERRUPT
, Connected
),
606 OFFSET(KINTERRUPT_Number
, KINTERRUPT
, Number
),
607 OFFSET(KINTERRUPT_ShareVector
, KINTERRUPT
, ShareVector
),
608 OFFSET(KINTERRUPT_Mode
, KINTERRUPT
, Mode
),
609 OFFSET(KINTERRUPT_ServiceCount
, KINTERRUPT
, ServiceCount
),
610 OFFSET(KINTERRUPT_DispatchCount
, KINTERRUPT
, DispatchCount
),
611 OFFSET(KINTERRUPT_TrapFrame
, KINTERRUPT
, TrapFrame
),
612 OFFSET(KINTERRUPT_DispatchCode
, KINTERRUPT
, DispatchCode
),