-
Notifications
You must be signed in to change notification settings - Fork 5
Expand file tree
/
Copy pathDebugStructs_x64.txt
More file actions
668 lines (611 loc) · 29.9 KB
/
DebugStructs_x64.txt
File metadata and controls
668 lines (611 loc) · 29.9 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
using System;
using System.Runtime.InteropServices;
using Microsoft.Diagnostics.Runtime.Interop;
namespace PSExt.Extension.x64
{
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x28)]
public struct ACTIVATION_CONTEXT_STACK
{
[FieldOffset(0x000)] public IntPtr ActiveFrame;
[FieldOffset(0x008)] public LIST_ENTRY FrameListCache;
[FieldOffset(0x018)] public UInt32 Flags;
[FieldOffset(0x01c)] public UInt32 NextCookieSequenceNumber;
[FieldOffset(0x020)] public UInt32 StackId;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x10)]
public unsafe struct CLIENT_ID
{
[FieldOffset(0x000)] public IntPtr UniqueProcess;
[FieldOffset(0x008)] public IntPtr UniqueThread;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x18)]
public unsafe struct CURDIR
{
[FieldOffset(0x000)] public UNICODE_STRING DosPath;
[FieldOffset(0x010)] public IntPtr Handle;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x10)]
public unsafe struct EXCEPTION_REGISTRATION_RECORD
{
[FieldOffset(0x000)] public IntPtr Next;
[FieldOffset(0x008)] public IntPtr* Handler;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x4e8)]
public unsafe struct GDI_TEB_BATCH
{
[FieldOffset(0x000)] public UInt32 BitField;
[FieldOffset(0x008)] public UInt64 HDC;
[FieldOffset(0x010)] public fixed UInt32 Buffer [310];
public UInt32 Offset => (UInt32)((BitField & 0x0000) >> 0);
public bool HasRenderingCommand => (BitField & 0x40000000) >> 31 == 1;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x10)]
public struct LIST_ENTRY
{
[FieldOffset(0x000)] public IntPtr Flink;
[FieldOffset(0x008)] public IntPtr Blink;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x38)]
public unsafe struct NT_TIB
{
[FieldOffset(0x000)] public IntPtr ExceptionList;
[FieldOffset(0x008)] public IntPtr StackBase;
[FieldOffset(0x010)] public IntPtr StackLimit;
[FieldOffset(0x018)] public IntPtr SubSystemTib;
[FieldOffset(0x020)] public IntPtr FiberData;
[FieldOffset(0x020)] public UInt32 Version;
[FieldOffset(0x028)] public IntPtr ArbitraryUserPointer;
[FieldOffset(0x030)] public IntPtr Self;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x7a0)]
public unsafe struct PEB
{
[FieldOffset(0x000)] public byte InheritedAddressSpace;
[FieldOffset(0x001)] public byte ReadImageFileExecOptions;
[FieldOffset(0x002)] public byte BeingDebugged;
[FieldOffset(0x003)] public byte BitField;
[FieldOffset(0x004)] public fixed byte Padding0 [4];
[FieldOffset(0x008)] public IntPtr Mutant;
[FieldOffset(0x010)] public IntPtr ImageBaseAddress;
[FieldOffset(0x018)] public IntPtr Ldr;
[FieldOffset(0x020)] public IntPtr ProcessParameters;
[FieldOffset(0x028)] public IntPtr SubSystemData;
[FieldOffset(0x030)] public IntPtr ProcessHeap;
[FieldOffset(0x038)] public IntPtr FastPebLock;
[FieldOffset(0x040)] public IntPtr AtlThunkSListPtr;
[FieldOffset(0x048)] public IntPtr IFEOKey;
[FieldOffset(0x050)] public UInt32 CrossProcessFlags;
[FieldOffset(0x054)] public fixed byte Padding1 [4];
[FieldOffset(0x058)] public IntPtr KernelCallbackTable;
[FieldOffset(0x058)] public IntPtr UserSharedInfoPtr;
[FieldOffset(0x060)] public fixed UInt32 SystemReserved [1];
[FieldOffset(0x064)] public UInt32 AtlThunkSListPtr32;
[FieldOffset(0x068)] public IntPtr ApiSetMap;
[FieldOffset(0x070)] public UInt32 TlsExpansionCounter;
[FieldOffset(0x074)] public fixed byte Padding2 [4];
[FieldOffset(0x078)] public IntPtr TlsBitmap;
[FieldOffset(0x080)] public fixed UInt32 TlsBitmapBits [2];
[FieldOffset(0x088)] public IntPtr ReadOnlySharedMemoryBase;
[FieldOffset(0x090)] public IntPtr SparePvoid0;
[FieldOffset(0x098)] public IntPtr ReadOnlyStaticServerData;
[FieldOffset(0x0a0)] public IntPtr AnsiCodePageData;
[FieldOffset(0x0a8)] public IntPtr OemCodePageData;
[FieldOffset(0x0b0)] public IntPtr UnicodeCaseTableData;
[FieldOffset(0x0b8)] public UInt32 NumberOfProcessors;
[FieldOffset(0x0bc)] public UInt32 NtGlobalFlag;
[FieldOffset(0x0c0)] public UInt64 CriticalSectionTimeout;
[FieldOffset(0x0c8)] public UInt64 HeapSegmentReserve;
[FieldOffset(0x0d0)] public UInt64 HeapSegmentCommit;
[FieldOffset(0x0d8)] public UInt64 HeapDeCommitTotalFreeThreshold;
[FieldOffset(0x0e0)] public UInt64 HeapDeCommitFreeBlockThreshold;
[FieldOffset(0x0e8)] public UInt32 NumberOfHeaps;
[FieldOffset(0x0ec)] public UInt32 MaximumNumberOfHeaps;
[FieldOffset(0x0f0)] public IntPtr ProcessHeaps;
[FieldOffset(0x0f8)] public IntPtr GdiSharedHandleTable;
[FieldOffset(0x100)] public IntPtr ProcessStarterHelper;
[FieldOffset(0x108)] public UInt32 GdiDCAttributeList;
[FieldOffset(0x10c)] public fixed byte Padding3 [4];
[FieldOffset(0x110)] public IntPtr LoaderLock;
[FieldOffset(0x118)] public UInt32 OSMajorVersion;
[FieldOffset(0x11c)] public UInt32 OSMinorVersion;
[FieldOffset(0x120)] public UInt16 OSBuildNumber;
[FieldOffset(0x122)] public UInt16 OSCSDVersion;
[FieldOffset(0x124)] public UInt32 OSPlatformId;
[FieldOffset(0x128)] public UInt32 ImageSubsystem;
[FieldOffset(0x12c)] public UInt32 ImageSubsystemMajorVersion;
[FieldOffset(0x130)] public UInt32 ImageSubsystemMinorVersion;
[FieldOffset(0x134)] public fixed byte Padding4 [4];
[FieldOffset(0x138)] public UInt64 ActiveProcessAffinityMask;
[FieldOffset(0x140)] public fixed UInt32 GdiHandleBuffer [60];
[FieldOffset(0x230)] public IntPtr PostProcessInitRoutine;
[FieldOffset(0x238)] public IntPtr TlsExpansionBitmap;
[FieldOffset(0x240)] public fixed UInt32 TlsExpansionBitmapBits [32];
[FieldOffset(0x2c0)] public UInt32 SessionId;
[FieldOffset(0x2c4)] public fixed byte Padding5 [4];
[FieldOffset(0x2c8)] public UInt64 AppCompatFlags;
[FieldOffset(0x2d0)] public UInt64 AppCompatFlagsUser;
[FieldOffset(0x2d8)] public IntPtr pShimData;
[FieldOffset(0x2e0)] public IntPtr AppCompatInfo;
[FieldOffset(0x2e8)] public UNICODE_STRING CSDVersion;
[FieldOffset(0x2f8)] public IntPtr ActivationContextData;
[FieldOffset(0x300)] public IntPtr ProcessAssemblyStorageMap;
[FieldOffset(0x308)] public IntPtr SystemDefaultActivationContextData;
[FieldOffset(0x310)] public IntPtr SystemAssemblyStorageMap;
[FieldOffset(0x318)] public UInt64 MinimumStackCommit;
[FieldOffset(0x320)] public IntPtr FlsCallback;
[FieldOffset(0x328)] public LIST_ENTRY FlsListHead;
[FieldOffset(0x338)] public IntPtr FlsBitmap;
[FieldOffset(0x340)] public fixed UInt32 FlsBitmapBits [4];
[FieldOffset(0x350)] public UInt32 FlsHighIndex;
[FieldOffset(0x358)] public IntPtr WerRegistrationData;
[FieldOffset(0x360)] public IntPtr WerShipAssertPtr;
[FieldOffset(0x368)] public IntPtr pUnused;
[FieldOffset(0x370)] public IntPtr pImageHeaderHash;
[FieldOffset(0x378)] public UInt32 TracingFlags;
[FieldOffset(0x37c)] public fixed byte Padding6 [4];
[FieldOffset(0x380)] public UInt64 CsrServerReadOnlySharedMemoryBase;
[FieldOffset(0x388)] public UInt64 TppWorkerpListLock;
[FieldOffset(0x390)] public LIST_ENTRY TppWorkerpList;
[FieldOffset(0x3a0)] public IntPtr WaitOnAddressHashTable;
public bool ImageUsesLargePages => (BitField & 0x80000000) >> 0 == 1;
public bool IsProtectedProcess => (BitField & 0x0001) >> 1 == 1;
public bool IsImageDynamicallyRelocated => (BitField & 0x0002) >> 2 == 1;
public bool SkipPatchingUser32Forwarders => (BitField & 0x0004) >> 3 == 1;
public bool IsPackagedProcess => (BitField & 0x0008) >> 4 == 1;
public bool IsAppContainer => (BitField & 0x0010) >> 5 == 1;
public bool IsProtectedProcessLight => (BitField & 0x0020) >> 6 == 1;
public bool SpareBits => (BitField & 0x0040) >> 7 == 1;
public bool ProcessInJob => (CrossProcessFlags & 0x80000000) >> 0 == 1;
public bool ProcessInitializing => (CrossProcessFlags & 0x0001) >> 1 == 1;
public bool ProcessUsingVEH => (CrossProcessFlags & 0x0002) >> 2 == 1;
public bool ProcessUsingVCH => (CrossProcessFlags & 0x0004) >> 3 == 1;
public bool ProcessUsingFTH => (CrossProcessFlags & 0x0008) >> 4 == 1;
public UInt32 ReservedBits0 => (UInt32)((CrossProcessFlags & 0x7FFFFFF0) >> 5);
public bool HeapTracingEnabled => (TracingFlags & 0x80000000) >> 0 == 1;
public bool CritSecTracingEnabled => (TracingFlags & 0x0001) >> 1 == 1;
public bool LibLoaderTracingEnabled => (TracingFlags & 0x0002) >> 2 == 1;
public UInt32 SpareTracingBits => (UInt32)((TracingFlags & 0x7FFFFFFC) >> 3);
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x58)]
public unsafe struct PEB_LDR_DATA
{
[FieldOffset(0x000)] public UInt32 Length;
[FieldOffset(0x004)] public byte Initialized;
[FieldOffset(0x008)] public IntPtr SsHandle;
[FieldOffset(0x010)] public LIST_ENTRY InLoadOrderModuleList;
[FieldOffset(0x020)] public LIST_ENTRY InMemoryOrderModuleList;
[FieldOffset(0x030)] public LIST_ENTRY InInitializationOrderModuleList;
[FieldOffset(0x040)] public IntPtr EntryInProgress;
[FieldOffset(0x048)] public byte ShutdownInProgress;
[FieldOffset(0x050)] public IntPtr ShutdownThreadId;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x4)]
public struct PROCESSOR_NUMBER
{
[FieldOffset(0x000)] public UInt16 Group;
[FieldOffset(0x002)] public byte Number;
[FieldOffset(0x003)] public byte Reserved;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x18)]
public struct RTL_ACTIVATION_CONTEXT_STACK_FRAME
{
[FieldOffset(0x000)] public IntPtr Previous;
[FieldOffset(0x008)] public IntPtr ActivationContext;
[FieldOffset(0x010)] public UInt32 Flags;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x28)]
public unsafe struct RTL_CRITICAL_SECTION
{
[FieldOffset(0x000)] public IntPtr DebugInfo;
[FieldOffset(0x008)] public Int32 LockCount;
[FieldOffset(0x00c)] public Int32 RecursionCount;
[FieldOffset(0x010)] public IntPtr OwningThread;
[FieldOffset(0x018)] public IntPtr LockSemaphore;
[FieldOffset(0x020)] public UInt64 SpinCount;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x30)]
public struct RTL_CRITICAL_SECTION_DEBUG
{
[FieldOffset(0x000)] public UInt16 Type;
[FieldOffset(0x002)] public UInt16 CreatorBackTraceIndex;
[FieldOffset(0x008)] public IntPtr CriticalSection;
[FieldOffset(0x010)] public LIST_ENTRY ProcessLocksList;
[FieldOffset(0x020)] public UInt32 EntryCount;
[FieldOffset(0x024)] public UInt32 ContentionCount;
[FieldOffset(0x028)] public UInt32 Flags;
[FieldOffset(0x02c)] public UInt16 CreatorBackTraceIndexHigh;
[FieldOffset(0x02e)] public UInt16 SpareWORD;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x18)]
public struct RTL_DRIVE_LETTER_CURDIR
{
[FieldOffset(0x000)] public UInt16 Flags;
[FieldOffset(0x002)] public UInt16 Length;
[FieldOffset(0x004)] public UInt32 TimeStamp;
[FieldOffset(0x008)] public STRING DosPath;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x410)]
public unsafe struct RTL_USER_PROCESS_PARAMETERS
{
[FieldOffset(0x000)] public UInt32 MaximumLength;
[FieldOffset(0x004)] public UInt32 Length;
[FieldOffset(0x008)] public UInt32 Flags;
[FieldOffset(0x00c)] public UInt32 DebugFlags;
[FieldOffset(0x010)] public IntPtr ConsoleHandle;
[FieldOffset(0x018)] public UInt32 ConsoleFlags;
[FieldOffset(0x020)] public IntPtr StandardInput;
[FieldOffset(0x028)] public IntPtr StandardOutput;
[FieldOffset(0x030)] public IntPtr StandardError;
[FieldOffset(0x038)] public CURDIR CurrentDirectory;
[FieldOffset(0x050)] public UNICODE_STRING DllPath;
[FieldOffset(0x060)] public UNICODE_STRING ImagePathName;
[FieldOffset(0x070)] public UNICODE_STRING CommandLine;
[FieldOffset(0x080)] public IntPtr Environment;
[FieldOffset(0x088)] public UInt32 StartingX;
[FieldOffset(0x08c)] public UInt32 StartingY;
[FieldOffset(0x090)] public UInt32 CountX;
[FieldOffset(0x094)] public UInt32 CountY;
[FieldOffset(0x098)] public UInt32 CountCharsX;
[FieldOffset(0x09c)] public UInt32 CountCharsY;
[FieldOffset(0x0a0)] public UInt32 FillAttribute;
[FieldOffset(0x0a4)] public UInt32 WindowFlags;
[FieldOffset(0x0a8)] public UInt32 ShowWindowFlags;
[FieldOffset(0x0b0)] public UNICODE_STRING WindowTitle;
[FieldOffset(0x0c0)] public UNICODE_STRING DesktopInfo;
[FieldOffset(0x0d0)] public UNICODE_STRING ShellInfo;
[FieldOffset(0x0e0)] public UNICODE_STRING RuntimeData;
[FieldOffset(0x0f0)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores0;
[FieldOffset(0x108)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores1;
[FieldOffset(0x120)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores2;
[FieldOffset(0x138)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores3;
[FieldOffset(0x150)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores4;
[FieldOffset(0x168)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores5;
[FieldOffset(0x180)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores6;
[FieldOffset(0x198)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores7;
[FieldOffset(0x1b0)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores8;
[FieldOffset(0x1c8)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores9;
[FieldOffset(0x1e0)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores10;
[FieldOffset(0x1f8)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores11;
[FieldOffset(0x210)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores12;
[FieldOffset(0x228)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores13;
[FieldOffset(0x240)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores14;
[FieldOffset(0x258)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores15;
[FieldOffset(0x270)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores16;
[FieldOffset(0x288)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores17;
[FieldOffset(0x2a0)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores18;
[FieldOffset(0x2b8)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores19;
[FieldOffset(0x2d0)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores20;
[FieldOffset(0x2e8)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores21;
[FieldOffset(0x300)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores22;
[FieldOffset(0x318)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores23;
[FieldOffset(0x330)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores24;
[FieldOffset(0x348)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores25;
[FieldOffset(0x360)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores26;
[FieldOffset(0x378)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores27;
[FieldOffset(0x390)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores28;
[FieldOffset(0x3a8)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores29;
[FieldOffset(0x3c0)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores30;
[FieldOffset(0x3d8)] public RTL_DRIVE_LETTER_CURDIR CurrentDirectores31;
[FieldOffset(0x3f0)] public UInt64 EnvironmentSize;
[FieldOffset(0x3f8)] public UInt64 EnvironmentVersion;
[FieldOffset(0x400)] public IntPtr PackageDependencyData;
[FieldOffset(0x408)] public UInt32 ProcessGroupId;
[FieldOffset(0x40c)] public UInt32 LoaderThreads;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x10)]
public unsafe struct STRING
{
[FieldOffset(0x000)] public UInt16 Length;
[FieldOffset(0x002)] public UInt16 MaximumLength;
[FieldOffset(0x008)] public byte* Buffer;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x1838)]
public unsafe struct TEB
{
[FieldOffset(0x000)] public NT_TIB NtTib;
[FieldOffset(0x038)] public IntPtr EnvironmentPointer;
[FieldOffset(0x040)] public CLIENT_ID ClientId;
[FieldOffset(0x050)] public IntPtr ActiveRpcHandle;
[FieldOffset(0x058)] public IntPtr ThreadLocalStoragePointer;
[FieldOffset(0x060)] public IntPtr ProcessEnvironmentBlock;
[FieldOffset(0x068)] public UInt32 LastErrorValue;
[FieldOffset(0x06c)] public UInt32 CountOfOwnedCriticalSections;
[FieldOffset(0x070)] public IntPtr CsrClientThread;
[FieldOffset(0x078)] public IntPtr Win32ThreadInfo;
[FieldOffset(0x080)] public fixed UInt32 User32Reserved [26];
[FieldOffset(0x0e8)] public fixed UInt32 UserReserved [5];
[FieldOffset(0x100)] public IntPtr WOW32Reserved;
[FieldOffset(0x108)] public UInt32 CurrentLocale;
[FieldOffset(0x10c)] public UInt32 FpSoftwareStatusRegister;
[FieldOffset(0x110)] public IntPtr ReservedForDebuggerInstrumentation;
[FieldOffset(0x190)] public IntPtr SystemReserved1;
[FieldOffset(0x2c0)] public Int32 ExceptionCode;
[FieldOffset(0x2c4)] public fixed byte Padding0 [4];
[FieldOffset(0x2c8)] public IntPtr ActivationContextStackPointer;
[FieldOffset(0x2d0)] public UInt64 InstrumentationCallbackSp;
[FieldOffset(0x2d8)] public UInt64 InstrumentationCallbackPreviousPc;
[FieldOffset(0x2e0)] public UInt64 InstrumentationCallbackPreviousSp;
[FieldOffset(0x2e8)] public UInt32 TxFsContext;
[FieldOffset(0x2ec)] public byte InstrumentationCallbackDisabled;
[FieldOffset(0x2ed)] public fixed byte Padding1 [3];
[FieldOffset(0x2f0)] public GDI_TEB_BATCH GdiTebBatch;
[FieldOffset(0x7d8)] public CLIENT_ID RealClientId;
[FieldOffset(0x7e8)] public IntPtr GdiCachedProcessHandle;
[FieldOffset(0x7f0)] public UInt32 GdiClientPID;
[FieldOffset(0x7f4)] public UInt32 GdiClientTID;
[FieldOffset(0x7f8)] public IntPtr GdiThreadLocalInfo;
[FieldOffset(0x800)] public fixed UInt64 Win32ClientInfo [62];
[FieldOffset(0x9f0)] public IntPtr glDispatchTable;
[FieldOffset(0x1138)] public fixed UInt64 glReserved1 [29];
[FieldOffset(0x1220)] public IntPtr glReserved2;
[FieldOffset(0x1228)] public IntPtr glSectionInfo;
[FieldOffset(0x1230)] public IntPtr glSection;
[FieldOffset(0x1238)] public IntPtr glTable;
[FieldOffset(0x1240)] public IntPtr glCurrentRC;
[FieldOffset(0x1248)] public IntPtr glContext;
[FieldOffset(0x1250)] public UInt32 LastStatusValue;
[FieldOffset(0x1254)] public fixed byte Padding2 [4];
[FieldOffset(0x1258)] public UNICODE_STRING StaticUnicodeString;
[FieldOffset(0x1268)] public byte StaticUnicodeBuffer;
[FieldOffset(0x1472)] public fixed byte Padding3 [6];
[FieldOffset(0x1478)] public IntPtr DeallocationStack;
[FieldOffset(0x1480)] public IntPtr TlsSlots;
[FieldOffset(0x1680)] public LIST_ENTRY TlsLinks;
[FieldOffset(0x1690)] public IntPtr Vdm;
[FieldOffset(0x1698)] public IntPtr ReservedForNtRpc;
[FieldOffset(0x16a0)] public IntPtr DbgSsReserved;
[FieldOffset(0x16b0)] public UInt32 HardErrorMode;
[FieldOffset(0x16b4)] public fixed byte Padding4 [4];
[FieldOffset(0x16b8)] public IntPtr Instrumentation;
[FieldOffset(0x1710)] public Guid ActivityId;
[FieldOffset(0x1720)] public IntPtr SubProcessTag;
[FieldOffset(0x1728)] public IntPtr PerflibData;
[FieldOffset(0x1730)] public IntPtr EtwTraceData;
[FieldOffset(0x1738)] public IntPtr WinSockData;
[FieldOffset(0x1740)] public UInt32 GdiBatchCount;
[FieldOffset(0x1744)] public PROCESSOR_NUMBER CurrentIdealProcessor;
[FieldOffset(0x1744)] public UInt32 IdealProcessorValue;
[FieldOffset(0x1744)] public byte ReservedPad0;
[FieldOffset(0x1745)] public byte ReservedPad1;
[FieldOffset(0x1746)] public byte ReservedPad2;
[FieldOffset(0x1747)] public byte IdealProcessor;
[FieldOffset(0x1748)] public UInt32 GuaranteedStackBytes;
[FieldOffset(0x174c)] public fixed byte Padding5 [4];
[FieldOffset(0x1750)] public IntPtr ReservedForPerf;
[FieldOffset(0x1758)] public IntPtr ReservedForOle;
[FieldOffset(0x1760)] public UInt32 WaitingOnLoaderLock;
[FieldOffset(0x1764)] public fixed byte Padding6 [4];
[FieldOffset(0x1768)] public IntPtr SavedPriorityState;
[FieldOffset(0x1770)] public UInt64 ReservedForCodeCoverage;
[FieldOffset(0x1778)] public IntPtr ThreadPoolData;
[FieldOffset(0x1780)] public IntPtr TlsExpansionSlots;
[FieldOffset(0x1788)] public IntPtr DeallocationBStore;
[FieldOffset(0x1790)] public IntPtr BStoreLimit;
[FieldOffset(0x1798)] public UInt32 MuiGeneration;
[FieldOffset(0x179c)] public UInt32 IsImpersonating;
[FieldOffset(0x17a0)] public IntPtr NlsCache;
[FieldOffset(0x17a8)] public IntPtr pShimData;
[FieldOffset(0x17b0)] public UInt16 HeapVirtualAffinity;
[FieldOffset(0x17b2)] public UInt16 LowFragHeapDataSlot;
[FieldOffset(0x17b4)] public fixed byte Padding7 [4];
[FieldOffset(0x17b8)] public IntPtr CurrentTransactionHandle;
[FieldOffset(0x17c0)] public IntPtr ActiveFrame;
[FieldOffset(0x17c8)] public IntPtr FlsData;
[FieldOffset(0x17d0)] public IntPtr PreferredLanguages;
[FieldOffset(0x17d8)] public IntPtr UserPrefLanguages;
[FieldOffset(0x17e0)] public IntPtr MergedPrefLanguages;
[FieldOffset(0x17e8)] public UInt32 MuiImpersonation;
[FieldOffset(0x17ec)] public UInt16 CrossTebFlags;
[FieldOffset(0x17ee)] public UInt16 SameTebFlags;
[FieldOffset(0x17f0)] public IntPtr TxnScopeEnterCallback;
[FieldOffset(0x17f8)] public IntPtr TxnScopeExitCallback;
[FieldOffset(0x1800)] public IntPtr TxnScopeContext;
[FieldOffset(0x1808)] public UInt32 LockCount;
[FieldOffset(0x180c)] public Int32 WowTebOffset;
[FieldOffset(0x1810)] public IntPtr ResourceRetValue;
[FieldOffset(0x1818)] public IntPtr ReservedForWdf;
[FieldOffset(0x1820)] public UInt64 ReservedForCrt;
[FieldOffset(0x1828)] public Guid EffectiveContainerId;
public UInt16 SpareCrossTebBits => (UInt16)((CrossTebFlags & 0x0000) >> 0);
public bool SafeThunkCall => (SameTebFlags & 0x80000000) >> 0 == 1;
public bool InDebugPrint => (SameTebFlags & 0x0001) >> 1 == 1;
public bool HasFiberData => (SameTebFlags & 0x0002) >> 2 == 1;
public bool SkipThreadAttach => (SameTebFlags & 0x0004) >> 3 == 1;
public bool WerInShipAssertCode => (SameTebFlags & 0x0008) >> 4 == 1;
public bool RanProcessInit => (SameTebFlags & 0x0010) >> 5 == 1;
public bool ClonedThread => (SameTebFlags & 0x0020) >> 6 == 1;
public bool SuppressDebugMsg => (SameTebFlags & 0x0040) >> 7 == 1;
public bool DisableUserStackWalk => (SameTebFlags & 0x0080) >> 8 == 1;
public bool RtlExceptionAttached => (SameTebFlags & 0x0100) >> 9 == 1;
public bool InitialThread => (SameTebFlags & 0x0200) >> 10 == 1;
public bool SessionAware => (SameTebFlags & 0x0400) >> 11 == 1;
public bool LoadOwner => (SameTebFlags & 0x0800) >> 12 == 1;
public bool LoaderWorker => (SameTebFlags & 0x1000) >> 13 == 1;
public UInt16 SpareSameTebBits => (UInt16)((SameTebFlags & 0x6000) >> 14);
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x18)]
public struct TEB_ACTIVE_FRAME
{
[FieldOffset(0x000)] public UInt32 Flags;
[FieldOffset(0x008)] public IntPtr Previous;
[FieldOffset(0x010)] public IntPtr Context;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x10)]
public unsafe struct TEB_ACTIVE_FRAME_CONTEXT
{
[FieldOffset(0x000)] public UInt32 Flags;
[FieldOffset(0x008)] public byte* FrameName;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x10)]
public unsafe struct UNICODE_STRING
{
[FieldOffset(0x000)] public UInt16 Length;
[FieldOffset(0x002)] public UInt16 MaximumLength;
[FieldOffset(0x008)] public UInt16* Buffer;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x4d0)]
public struct CONTEXT
{
[FieldOffset(0x000)] public UInt64 P1Home;
[FieldOffset(0x008)] public UInt64 P2Home;
[FieldOffset(0x010)] public UInt64 P3Home;
[FieldOffset(0x018)] public UInt64 P4Home;
[FieldOffset(0x020)] public UInt64 P5Home;
[FieldOffset(0x028)] public UInt64 P6Home;
[FieldOffset(0x030)] public UInt32 ContextFlags;
[FieldOffset(0x034)] public UInt32 MxCsr;
[FieldOffset(0x038)] public UInt16 SegCs;
[FieldOffset(0x03a)] public UInt16 SegDs;
[FieldOffset(0x03c)] public UInt16 SegEs;
[FieldOffset(0x03e)] public UInt16 SegFs;
[FieldOffset(0x040)] public UInt16 SegGs;
[FieldOffset(0x042)] public UInt16 SegSs;
[FieldOffset(0x044)] public UInt32 EFlags;
[FieldOffset(0x048)] public UInt64 Dr0;
[FieldOffset(0x050)] public UInt64 Dr1;
[FieldOffset(0x058)] public UInt64 Dr2;
[FieldOffset(0x060)] public UInt64 Dr3;
[FieldOffset(0x068)] public UInt64 Dr6;
[FieldOffset(0x070)] public UInt64 Dr7;
[FieldOffset(0x078)] public UInt64 Rax;
[FieldOffset(0x080)] public UInt64 Rcx;
[FieldOffset(0x088)] public UInt64 Rdx;
[FieldOffset(0x090)] public UInt64 Rbx;
[FieldOffset(0x098)] public UInt64 Rsp;
[FieldOffset(0x0a0)] public UInt64 Rbp;
[FieldOffset(0x0a8)] public UInt64 Rsi;
[FieldOffset(0x0b0)] public UInt64 Rdi;
[FieldOffset(0x0b8)] public UInt64 R8;
[FieldOffset(0x0c0)] public UInt64 R9;
[FieldOffset(0x0c8)] public UInt64 R10;
[FieldOffset(0x0d0)] public UInt64 R11;
[FieldOffset(0x0d8)] public UInt64 R12;
[FieldOffset(0x0e0)] public UInt64 R13;
[FieldOffset(0x0e8)] public UInt64 R14;
[FieldOffset(0x0f0)] public UInt64 R15;
[FieldOffset(0x0f8)] public UInt64 Rip;
[FieldOffset(0x100)] public XSAVE_FORMAT FltSave;
[FieldOffset(0x100)] public F128PARTS64 Header0;
[FieldOffset(0x110)] public F128PARTS64 Header1;
[FieldOffset(0x120)] public F128PARTS64 Legacy0;
[FieldOffset(0x130)] public F128PARTS64 Legacy1;
[FieldOffset(0x140)] public F128PARTS64 Legacy2;
[FieldOffset(0x150)] public F128PARTS64 Legacy3;
[FieldOffset(0x160)] public F128PARTS64 Legacy4;
[FieldOffset(0x170)] public F128PARTS64 Legacy5;
[FieldOffset(0x180)] public F128PARTS64 Legacy6;
[FieldOffset(0x190)] public F128PARTS64 Legacy7;
[FieldOffset(0x1a0)] public F128PARTS64 Xmm0;
[FieldOffset(0x1b0)] public F128PARTS64 Xmm1;
[FieldOffset(0x1c0)] public F128PARTS64 Xmm2;
[FieldOffset(0x1d0)] public F128PARTS64 Xmm3;
[FieldOffset(0x1e0)] public F128PARTS64 Xmm4;
[FieldOffset(0x1f0)] public F128PARTS64 Xmm5;
[FieldOffset(0x200)] public F128PARTS64 Xmm6;
[FieldOffset(0x210)] public F128PARTS64 Xmm7;
[FieldOffset(0x220)] public F128PARTS64 Xmm8;
[FieldOffset(0x230)] public F128PARTS64 Xmm9;
[FieldOffset(0x240)] public F128PARTS64 Xmm10;
[FieldOffset(0x250)] public F128PARTS64 Xmm11;
[FieldOffset(0x260)] public F128PARTS64 Xmm12;
[FieldOffset(0x270)] public F128PARTS64 Xmm13;
[FieldOffset(0x280)] public F128PARTS64 Xmm14;
[FieldOffset(0x290)] public F128PARTS64 Xmm15;
[FieldOffset(0x300)] public F128PARTS64 VectorRegister0;
[FieldOffset(0x310)] public F128PARTS64 VectorRegister1;
[FieldOffset(0x320)] public F128PARTS64 VectorRegister2;
[FieldOffset(0x330)] public F128PARTS64 VectorRegister3;
[FieldOffset(0x340)] public F128PARTS64 VectorRegister4;
[FieldOffset(0x350)] public F128PARTS64 VectorRegister5;
[FieldOffset(0x360)] public F128PARTS64 VectorRegister6;
[FieldOffset(0x370)] public F128PARTS64 VectorRegister7;
[FieldOffset(0x380)] public F128PARTS64 VectorRegister8;
[FieldOffset(0x390)] public F128PARTS64 VectorRegister9;
[FieldOffset(0x3a0)] public F128PARTS64 VectorRegister10;
[FieldOffset(0x3b0)] public F128PARTS64 VectorRegister11;
[FieldOffset(0x3c0)] public F128PARTS64 VectorRegister12;
[FieldOffset(0x3d0)] public F128PARTS64 VectorRegister13;
[FieldOffset(0x3e0)] public F128PARTS64 VectorRegister14;
[FieldOffset(0x3f0)] public F128PARTS64 VectorRegister15;
[FieldOffset(0x400)] public F128PARTS64 VectorRegister16;
[FieldOffset(0x410)] public F128PARTS64 VectorRegister17;
[FieldOffset(0x420)] public F128PARTS64 VectorRegister18;
[FieldOffset(0x430)] public F128PARTS64 VectorRegister19;
[FieldOffset(0x440)] public F128PARTS64 VectorRegister20;
[FieldOffset(0x450)] public F128PARTS64 VectorRegister21;
[FieldOffset(0x460)] public F128PARTS64 VectorRegister22;
[FieldOffset(0x470)] public F128PARTS64 VectorRegister23;
[FieldOffset(0x480)] public F128PARTS64 VectorRegister24;
[FieldOffset(0x490)] public F128PARTS64 VectorRegister25;
[FieldOffset(0x4a0)] public UInt64 VectorControl;
[FieldOffset(0x4a8)] public UInt64 DebugControl;
[FieldOffset(0x4b0)] public UInt64 LastBranchToRip;
[FieldOffset(0x4b8)] public UInt64 LastBranchFromRip;
[FieldOffset(0x4c0)] public UInt64 LastExceptionToRip;
[FieldOffset(0x4c8)] public UInt64 LastExceptionFromRip;
}
/// Generated by SystemStruct.ps1
[StructLayout(LayoutKind.Explicit, Size=0x200)]
public unsafe struct XSAVE_FORMAT
{
[FieldOffset(0x000)] public UInt16 ControlWord;
[FieldOffset(0x002)] public UInt16 StatusWord;
[FieldOffset(0x004)] public byte TagWord;
[FieldOffset(0x005)] public byte Reserved1;
[FieldOffset(0x006)] public UInt16 ErrorOpcode;
[FieldOffset(0x008)] public UInt32 ErrorOffset;
[FieldOffset(0x00c)] public UInt16 ErrorSelector;
[FieldOffset(0x00e)] public UInt16 Reserved2;
[FieldOffset(0x010)] public UInt32 DataOffset;
[FieldOffset(0x014)] public UInt16 DataSelector;
[FieldOffset(0x016)] public UInt16 Reserved3;
[FieldOffset(0x018)] public UInt32 MxCsr;
[FieldOffset(0x01c)] public UInt32 MxCsr_Mask;
[FieldOffset(0x020)] public F128PARTS64 FloatRegisters0;
[FieldOffset(0x030)] public F128PARTS64 FloatRegisters1;
[FieldOffset(0x040)] public F128PARTS64 FloatRegisters2;
[FieldOffset(0x050)] public F128PARTS64 FloatRegisters3;
[FieldOffset(0x060)] public F128PARTS64 FloatRegisters4;
[FieldOffset(0x070)] public F128PARTS64 FloatRegisters5;
[FieldOffset(0x080)] public F128PARTS64 FloatRegisters6;
[FieldOffset(0x090)] public F128PARTS64 FloatRegisters7;
[FieldOffset(0x0a0)] public F128PARTS64 XmmRegisters0;
[FieldOffset(0x0b0)] public F128PARTS64 XmmRegisters1;
[FieldOffset(0x0c0)] public F128PARTS64 XmmRegisters2;
[FieldOffset(0x0d0)] public F128PARTS64 XmmRegisters3;
[FieldOffset(0x0e0)] public F128PARTS64 XmmRegisters4;
[FieldOffset(0x0f0)] public F128PARTS64 XmmRegisters5;
[FieldOffset(0x100)] public F128PARTS64 XmmRegisters6;
[FieldOffset(0x110)] public F128PARTS64 XmmRegisters7;
[FieldOffset(0x120)] public F128PARTS64 XmmRegisters8;
[FieldOffset(0x130)] public F128PARTS64 XmmRegisters9;
[FieldOffset(0x140)] public F128PARTS64 XmmRegisters10;
[FieldOffset(0x150)] public F128PARTS64 XmmRegisters11;
[FieldOffset(0x160)] public F128PARTS64 XmmRegisters12;
[FieldOffset(0x170)] public F128PARTS64 XmmRegisters13;
[FieldOffset(0x180)] public F128PARTS64 XmmRegisters14;
[FieldOffset(0x190)] public F128PARTS64 XmmRegisters15;
[FieldOffset(0x1a0)] public fixed byte Reserved4 [96];
}
}