#define UNLOADED_FILE 1 #include static main(void) { Enums(); // enumerations Structures(); // structure types } //------------------------------------------------------------------------ // Information about enum types static Enums(void) { auto id; // enum id } //------------------------------------------------------------------------ // Information about structure types static Structures(void) { auto id; id = AddStrucEx(-1,"_KEVENT",0); id = AddStrucEx(-1,"_KDPC",0); id = AddStrucEx(-1,"_KDEVICE_QUEUE",0); id = AddStrucEx(-1,"_KDEVICE_QUEUE_ENTRY",0); id = AddStrucEx(-1,"_WAIT_CONTEXT_BLOCK",0); id = AddStrucEx(-1,"_DEVICE_OBJECT::$178C8E784DFB44063357A0503D7C08A7",1); id = AddStrucEx(-1,"_UNICODE_STRING",0); id = AddStrucEx(-1,"_DEVICE_OBJECT",0); id = AddStrucEx(-1,"_CLIENT_ID",0); id = AddStrucEx(-1,"_DRIVER_OBJECT",0); id = AddStrucEx(-1,"_NAMED_PIPE_CREATE_PARAMETERS",0); id = AddStrucEx(-1,"_KSEMAPHORE",0); id = AddStrucEx(-1,"_KAPC",0); id = AddStrucEx(-1,"_ULARGE_INTEGER::$0354AA9C204208F00D0965D07BBE7FAC",0); id = AddStrucEx(-1,"_ULARGE_INTEGER",1); id = AddStrucEx(-1,"_KTIMER",0); id = AddStrucEx(-1,"_KWAIT_BLOCK",0); id = AddStrucEx(-1,"_KAPC_STATE",0); id = AddStrucEx(-1,"_DISPATCHER_HEADER",0); id = AddStrucEx(-1,"_KTHREAD",0); id = AddStrucEx(-1,"_FXSAVE_FORMAT",0); id = AddStrucEx(-1,"_ETHREAD",0); id = AddStrucEx(-1,"_FNSAVE_FORMAT",0); id = AddStrucEx(-1,"_FX_SAVE_AREA::$E170318795E00A54D871FA8DA393D9F9",1); id = AddStrucEx(-1,"_FX_SAVE_AREA",0); id = AddStrucEx(-1,"PROCESSOR_IDLE_TIMES",0); id = AddStrucEx(-1,"LARGE_INTEGER",1); id = AddStrucEx(-1,"_PROCESSOR_POWER_STATE",0); id = AddStrucEx(-1,"_LARGE_INTEGER::$837407842DC9087486FDFA5FEB63B74E",0); id = AddStrucEx(-1,"_LARGE_INTEGER",1); id = AddStrucEx(-1,"_LIST_ENTRY",0); id = AddStrucEx(-1,"_PP_LOOKASIDE_LIST",0); id = AddStrucEx(-1,"_KSPIN_LOCK_QUEUE",0); id = AddStrucEx(-1,"_DESCRIPTOR",0); id = AddStrucEx(-1,"_KSPECIAL_REGISTERS",0); id = AddStrucEx(-1,"FLOATING_SAVE_AREA",0); id = AddStrucEx(-1,"_CONTEXT",0); id = AddStrucEx(-1,"_KPROCESSOR_STATE",0); id = AddStrucEx(-1,"_KPRCB",0); id = AddStrucEx(-1,"_NT_TIB::$0349ADB4452EC09BEC08E2292695FBBA",1); id = AddStrucEx(-1,"_NT_TIB",0); id = AddStrucEx(-1,"_KPCR",0); id = GetStrucIdByName("_KEVENT"); AddStrucMember(id,"Header", 0x0, 0x60000400, GetStrucIdByName("_DISPATCHER_HEADER"), 16); id = GetStrucIdByName("_KDPC"); AddStrucMember(id,"Type", 0x0, 0x10000400, -1, 2); AddStrucMember(id,"Number", 0x2, 0x000400, -1, 1); AddStrucMember(id,"Importance", 0x3, 0x000400, -1, 1); AddStrucMember(id,"DpcListEntry", 0x4, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"DeferredRoutine", 0xc, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"DeferredContext", 0x10, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"SystemArgument1", 0x14, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"SystemArgument2", 0x18, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Lock", 0x1c, 0x25500400, 0xffffffff, 4); id = GetStrucIdByName("_KDEVICE_QUEUE"); AddStrucMember(id,"Type", 0x0, 0x10000400, -1, 2); AddStrucMember(id,"Size", 0x2, 0x10000400, -1, 2); AddStrucMember(id,"DeviceListHead", 0x4, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"Lock", 0xc, 0x20000400, -1, 4); AddStrucMember(id,"Busy", 0x10, 0x000400, -1, 1); id = GetStrucIdByName("_KDEVICE_QUEUE_ENTRY"); AddStrucMember(id,"DeviceListEntry", 0x0, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"SortKey", 0x8, 0x20000400, -1, 4); AddStrucMember(id,"Inserted", 0xc, 0x000400, -1, 1); id = GetStrucIdByName("_WAIT_CONTEXT_BLOCK"); AddStrucMember(id,"WaitQueueEntry", 0x0, 0x60000400, GetStrucIdByName("_KDEVICE_QUEUE_ENTRY"), 13); AddStrucMember(id,"DeviceRoutine", 0x10, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"DeviceContext", 0x14, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"NumberOfMapRegisters", 0x18, 0x20000400, -1, 4); AddStrucMember(id,"DeviceObject", 0x1c, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"CurrentIrp", 0x20, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"BufferChainingDpc", 0x24, 0x25500400, 0xffffffff, 4); id = GetStrucIdByName("_DEVICE_OBJECT::$178C8E784DFB44063357A0503D7C08A7"); AddStrucMember(id,"ListEntry", 0x0, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"Wcb", 0x0, 0x60000400, GetStrucIdByName("_WAIT_CONTEXT_BLOCK"), 40); id = GetStrucIdByName("_UNICODE_STRING"); AddStrucMember(id,"Length", 0x0, 0x10000400, -1, 2); AddStrucMember(id,"MaximumLength", 0x2, 0x10000400, -1, 2); AddStrucMember(id,"Buffer", 0x4, 0x25500400, 0xffffffff, 4); id = GetStrucIdByName("_DEVICE_OBJECT"); AddStrucMember(id,"Type", 0x0, 0x10000400, -1, 2); AddStrucMember(id,"Size", 0x2, 0x10000400, -1, 2); AddStrucMember(id,"ReferenceCount", 0x4, 0x20000400, -1, 4); AddStrucMember(id,"DriverObject", 0x8, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"NextDevice", 0xc, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"AttachedDevice", 0x10, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"CurrentIrp", 0x14, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Timer", 0x18, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Flags", 0x1c, 0x20000400, -1, 4); AddStrucMember(id,"Characteristics", 0x20, 0x20000400, -1, 4); AddStrucMember(id,"Vpb", 0x24, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"DeviceExtension", 0x28, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"DeviceType", 0x2c, 0x20000400, -1, 4); AddStrucMember(id,"StackSize", 0x30, 0x000400, -1, 1); AddStrucMember(id,"Queue", 0x34, 0x60000400, GetStrucIdByName("_DEVICE_OBJECT::$178C8E784DFB44063357A0503D7C08A7"), 40); AddStrucMember(id,"AlignmentRequirement", 0x5c, 0x20000400, -1, 4); AddStrucMember(id,"DeviceQueue", 0x60, 0x60000400, GetStrucIdByName("_KDEVICE_QUEUE"), 17); AddStrucMember(id,"Dpc", 0x74, 0x60000400, GetStrucIdByName("_KDPC"), 32); AddStrucMember(id,"ActiveThreadCount", 0x94, 0x20000400, -1, 4); AddStrucMember(id,"SecurityDescriptor", 0x98, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"DeviceLock", 0x9c, 0x60000400, GetStrucIdByName("_KEVENT"), 16); AddStrucMember(id,"SectorSize", 0xac, 0x10000400, -1, 2); AddStrucMember(id,"Spare1", 0xae, 0x10000400, -1, 2); AddStrucMember(id,"DeviceObjectExtension", 0xb0, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Reserved", 0xb4, 0x25500400, 0xffffffff, 4); id = GetStrucIdByName("_CLIENT_ID"); AddStrucMember(id,"UniqueProcess", 0x0, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"UniqueThread", 0x4, 0x25500400, 0xffffffff, 4); id = GetStrucIdByName("_DRIVER_OBJECT"); AddStrucMember(id,"Type", 0x0, 0x10000400, -1, 2); AddStrucMember(id,"Size", 0x2, 0x10000400, -1, 2); AddStrucMember(id,"DeviceObject", 0x4, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Flags", 0x8, 0x20000400, -1, 4); AddStrucMember(id,"DriverStart", 0xc, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"DriverSize", 0x10, 0x20000400, -1, 4); AddStrucMember(id,"DriverSection", 0x14, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"DriverExtension", 0x18, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"DriverName", 0x1c, 0x60000400, GetStrucIdByName("_UNICODE_STRING"), 8); AddStrucMember(id,"HardwareDatabase", 0x24, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"FastIoDispatch", 0x28, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"DriverInit", 0x2c, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"DriverStartIo", 0x30, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"DriverUnload", 0x34, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"MajorFunction", 0x38, 0x25500400, 0xffffffff, 112); id = GetStrucIdByName("_NAMED_PIPE_CREATE_PARAMETERS"); AddStrucMember(id,"NamedPipeType", 0x0, 0x20000400, -1, 4); AddStrucMember(id,"ReadMode", 0x4, 0x20000400, -1, 4); AddStrucMember(id,"CompletionMode", 0x8, 0x20000400, -1, 4); AddStrucMember(id,"MaximumInstances", 0xc, 0x20000400, -1, 4); AddStrucMember(id,"InboundQuota", 0x10, 0x20000400, -1, 4); AddStrucMember(id,"OutboundQuota", 0x14, 0x20000400, -1, 4); AddStrucMember(id,"DefaultTimeout", 0x18, 0x60000400, GetStrucIdByName("_LARGE_INTEGER"), 8); AddStrucMember(id,"TimeoutSpecified", 0x20, 0x000400, -1, 1); id = GetStrucIdByName("_KSEMAPHORE"); AddStrucMember(id,"Header", 0x0, 0x60000400, GetStrucIdByName("_DISPATCHER_HEADER"), 16); AddStrucMember(id,"Limit", 0x10, 0x20000400, -1, 4); id = GetStrucIdByName("_KAPC"); AddStrucMember(id,"Type", 0x0, 0x10000400, -1, 2); AddStrucMember(id,"Size", 0x2, 0x10000400, -1, 2); AddStrucMember(id,"Spare0", 0x4, 0x20000400, -1, 4); AddStrucMember(id,"Thread", 0x8, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"ApcListEntry", 0xc, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"KernelRoutine", 0x14, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"RundownRoutine", 0x18, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"NormalRoutine", 0x1c, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"NormalContext", 0x20, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"SystemArgument1", 0x24, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"SystemArgument2", 0x28, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"ApcStateIndex", 0x2c, 0x000400, -1, 1); AddStrucMember(id,"ApcMode", 0x2d, 0x000400, -1, 1); AddStrucMember(id,"Inserted", 0x2e, 0x000400, -1, 1); id = GetStrucIdByName("_ULARGE_INTEGER::$0354AA9C204208F00D0965D07BBE7FAC"); AddStrucMember(id,"LowPart", 0x0, 0x20000400, -1, 4); AddStrucMember(id,"HighPart", 0x4, 0x20000400, -1, 4); id = GetStrucIdByName("_ULARGE_INTEGER"); AddStrucMember(id,"anonymous_0", 0x0, 0x60000400, GetStrucIdByName("_ULARGE_INTEGER::$0354AA9C204208F00D0965D07BBE7FAC"), 8); AddStrucMember(id,"u", 0x0, 0x60000400, GetStrucIdByName("_ULARGE_INTEGER::$0354AA9C204208F00D0965D07BBE7FAC"), 8); AddStrucMember(id,"QuadPart", 0x0, 0x30000400, -1, 8); id = GetStrucIdByName("_KTIMER"); AddStrucMember(id,"Header", 0x0, 0x60000400, GetStrucIdByName("_DISPATCHER_HEADER"), 16); AddStrucMember(id,"DueTime", 0x10, 0x60000400, GetStrucIdByName("_ULARGE_INTEGER"), 8); AddStrucMember(id,"TimerListEntry", 0x18, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"Dpc", 0x20, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Period", 0x24, 0x20000400, -1, 4); id = GetStrucIdByName("_KWAIT_BLOCK"); AddStrucMember(id,"WaitListEntry", 0x0, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"Thread", 0x8, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Object", 0xc, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"NextWaitBlock", 0x10, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"WaitKey", 0x14, 0x10000400, -1, 2); AddStrucMember(id,"WaitType", 0x16, 0x10000400, -1, 2); id = GetStrucIdByName("_KAPC_STATE"); AddStrucMember(id,"ApcListHead", 0x0, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 16); AddStrucMember(id,"Process", 0x10, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"KernelApcInProgress", 0x14, 0x000400, -1, 1); AddStrucMember(id,"KernelApcPending", 0x15, 0x000400, -1, 1); AddStrucMember(id,"UserApcPending", 0x16, 0x000400, -1, 1); id = GetStrucIdByName("_DISPATCHER_HEADER"); AddStrucMember(id,"Type", 0x0, 0x000400, -1, 1); AddStrucMember(id,"Absolute", 0x1, 0x000400, -1, 1); AddStrucMember(id,"Size", 0x2, 0x000400, -1, 1); AddStrucMember(id,"Inserted", 0x3, 0x000400, -1, 1); AddStrucMember(id,"SignalState", 0x4, 0x20000400, -1, 4); AddStrucMember(id,"WaitListHead", 0x8, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); id = GetStrucIdByName("_KTHREAD"); AddStrucMember(id,"Header", 0x0, 0x60000400, GetStrucIdByName("_DISPATCHER_HEADER"), 16); AddStrucMember(id,"MutantListHead", 0x10, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"InitialStack", 0x18, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"StackLimit", 0x1c, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Teb", 0x20, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"TlsArray", 0x24, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"KernelStack", 0x28, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"DebugActive", 0x2c, 0x000400, -1, 1); AddStrucMember(id,"State", 0x2d, 0x000400, -1, 1); AddStrucMember(id,"Alerted", 0x2e, 0x000400, -1, 2); AddStrucMember(id,"Iopl", 0x30, 0x000400, -1, 1); AddStrucMember(id,"NpxState", 0x31, 0x000400, -1, 1); AddStrucMember(id,"Saturation", 0x32, 0x000400, -1, 1); AddStrucMember(id,"Priority", 0x33, 0x000400, -1, 1); AddStrucMember(id,"ApcState", 0x34, 0x60000400, GetStrucIdByName("_KAPC_STATE"), 23); AddStrucMember(id,"ContextSwitches", 0x4c, 0x20000400, -1, 4); AddStrucMember(id,"WaitStatus", 0x50, 0x20000400, -1, 4); AddStrucMember(id,"WaitIrql", 0x54, 0x000400, -1, 1); AddStrucMember(id,"WaitMode", 0x55, 0x000400, -1, 1); AddStrucMember(id,"WaitNext", 0x56, 0x000400, -1, 1); AddStrucMember(id,"WaitReason", 0x57, 0x000400, -1, 1); AddStrucMember(id,"WaitBlockList", 0x58, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"WaitListEntry", 0x5c, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"WaitTime", 0x64, 0x20000400, -1, 4); AddStrucMember(id,"BasePriority", 0x68, 0x000400, -1, 1); AddStrucMember(id,"DecrementCount", 0x69, 0x000400, -1, 1); AddStrucMember(id,"PriorityDecrement", 0x6a, 0x000400, -1, 1); AddStrucMember(id,"Quantum", 0x6b, 0x000400, -1, 1); AddStrucMember(id,"WaitBlock", 0x6c, 0x60000400, GetStrucIdByName("_KWAIT_BLOCK"), 96); AddStrucMember(id,"LegoData", 0xcc, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"KernelApcDisable", 0xd0, 0x20000400, -1, 4); AddStrucMember(id,"UserAffinity", 0xd4, 0x20000400, -1, 4); AddStrucMember(id,"SystemAffinityActive", 0xd8, 0x000400, -1, 1); AddStrucMember(id,"PowerState", 0xd9, 0x000400, -1, 1); AddStrucMember(id,"NpxIrql", 0xda, 0x000400, -1, 1); AddStrucMember(id,"Pad", 0xdb, 0x000400, -1, 1); AddStrucMember(id,"ServiceTable", 0xdc, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Queue", 0xe0, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"ApcQueueLock", 0xe4, 0x20000400, -1, 4); AddStrucMember(id,"Timer", 0xe8, 0x60000400, GetStrucIdByName("_KTIMER"), 40); AddStrucMember(id,"QueueListEntry", 0x110, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"Affinity", 0x118, 0x20000400, -1, 4); AddStrucMember(id,"Preempted", 0x11c, 0x000400, -1, 1); AddStrucMember(id,"ProcessReadyQueue", 0x11d, 0x000400, -1, 1); AddStrucMember(id,"KernelStackResident", 0x11e, 0x000400, -1, 1); AddStrucMember(id,"NextProcessor", 0x11f, 0x000400, -1, 1); AddStrucMember(id,"CallbackStack", 0x120, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Win32Thread", 0x124, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"TrapFrame", 0x128, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"ApcStatePointer", 0x12c, 0x25500400, 0xffffffff, 8); AddStrucMember(id,"PreviousMode", 0x134, 0x000400, -1, 1); AddStrucMember(id,"EnableStackSwap", 0x135, 0x000400, -1, 1); AddStrucMember(id,"LargeStack", 0x136, 0x000400, -1, 1); AddStrucMember(id,"ResourceIndex", 0x137, 0x000400, -1, 1); AddStrucMember(id,"KernelTime", 0x138, 0x20000400, -1, 4); AddStrucMember(id,"UserTime", 0x13c, 0x20000400, -1, 4); AddStrucMember(id,"SavedApcState", 0x140, 0x60000400, GetStrucIdByName("_KAPC_STATE"), 23); AddStrucMember(id,"Alertable", 0x157, 0x000400, -1, 1); AddStrucMember(id,"ApcStateIndex", 0x158, 0x000400, -1, 1); AddStrucMember(id,"ApcQueueable", 0x159, 0x000400, -1, 1); AddStrucMember(id,"AutoAlignment", 0x15a, 0x000400, -1, 1); AddStrucMember(id,"StackBase", 0x15c, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"SuspendApc", 0x160, 0x60000400, GetStrucIdByName("_KAPC"), 47); AddStrucMember(id,"SuspendSemaphore", 0x190, 0x60000400, GetStrucIdByName("_KSEMAPHORE"), 20); AddStrucMember(id,"ThreadListEntry", 0x1a4, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"FreezeCount", 0x1ac, 0x000400, -1, 1); AddStrucMember(id,"SuspendCount", 0x1ad, 0x000400, -1, 1); AddStrucMember(id,"IdealProcessor", 0x1ae, 0x000400, -1, 1); AddStrucMember(id,"DisableBoost", 0x1af, 0x000400, -1, 1); id = GetStrucIdByName("_FXSAVE_FORMAT"); AddStrucMember(id,"ControlWord", 0x0, 0x10000400, -1, 2); AddStrucMember(id,"StatusWord", 0x2, 0x10000400, -1, 2); AddStrucMember(id,"TagWord", 0x4, 0x10000400, -1, 2); AddStrucMember(id,"ErrorOpcode", 0x6, 0x10000400, -1, 2); AddStrucMember(id,"ErrorOffset", 0x8, 0x20000400, -1, 4); AddStrucMember(id,"ErrorSelector", 0xc, 0x20000400, -1, 4); AddStrucMember(id,"DataOffset", 0x10, 0x20000400, -1, 4); AddStrucMember(id,"DataSelector", 0x14, 0x20000400, -1, 4); AddStrucMember(id,"MXCsr", 0x18, 0x20000400, -1, 4); AddStrucMember(id,"Reserved2", 0x1c, 0x20000400, -1, 4); AddStrucMember(id,"RegisterArea", 0x20, 0x000400, -1, 128); AddStrucMember(id,"Reserved3", 0xa0, 0x000400, -1, 128); AddStrucMember(id,"Reserved4", 0x120, 0x000400, -1, 224); AddStrucMember(id,"Align16Byte", 0x200, 0x000400, -1, 8); id = GetStrucIdByName("_ETHREAD"); AddStrucMember(id,"Tcb", 0x0, 0x60000400, GetStrucIdByName("_KTHREAD"), 432); AddStrucMember(id,"CreateTime", 0x1b0, 0x60000400, GetStrucIdByName("_LARGE_INTEGER"), 8); AddStrucMember(id,"ApcNeeded", 0x1b8, 0x20000400, -1, 4); AddStrucMember(id,"ExitTime", 0x1bc, 0x60000400, GetStrucIdByName("_LARGE_INTEGER"), 8); AddStrucMember(id,"LpcReplyChain", 0x1c4, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"ExitStatus", 0x1cc, 0x20000400, -1, 4); AddStrucMember(id,"OfsChain", 0x1d0, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"PostBlockList", 0x1d4, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"TerminationPortList", 0x1dc, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"ActiveTimerListLock", 0x1e4, 0x20000400, -1, 4); AddStrucMember(id,"ActiveTimerListHead", 0x1e8, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"Cid", 0x1f0, 0x60000400, GetStrucIdByName("_CLIENT_ID"), 8); AddStrucMember(id,"LpcReplySemaphore", 0x1f8, 0x60000400, GetStrucIdByName("_KSEMAPHORE"), 20); AddStrucMember(id,"LpcReplyMessage", 0x20c, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"LpcReplyMessageId", 0x210, 0x20000400, -1, 4); AddStrucMember(id,"PerformanceCountLow", 0x214, 0x20000400, -1, 4); AddStrucMember(id,"ImpersonationInfo", 0x218, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"IrpList", 0x21c, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"TopLevelIrp", 0x224, 0x20000400, -1, 4); AddStrucMember(id,"DeviceToVerify", 0x228, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"ReadClusterSize", 0x22c, 0x20000400, -1, 4); AddStrucMember(id,"ForwardClusterOnly", 0x230, 0x000400, -1, 1); AddStrucMember(id,"DisablePageFaultClustering", 0x231, 0x000400, -1, 1); AddStrucMember(id,"DeadThread", 0x232, 0x000400, -1, 1); AddStrucMember(id,"HideFromDebugger", 0x233, 0x000400, -1, 1); AddStrucMember(id,"HasTerminated", 0x234, 0x20000400, -1, 4); AddStrucMember(id,"GrantedAccess", 0x238, 0x20000400, -1, 4); AddStrucMember(id,"ThreadsProcess", 0x23c, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"StartAddress", 0x240, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Win32StartAddress", 0x244, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"LpcReceivedMessageId", 0x248, 0x20000400, -1, 4); AddStrucMember(id,"LpcExitThreadCalled", 0x24c, 0x000400, -1, 1); AddStrucMember(id,"HardErrorsAreDisabled", 0x24d, 0x000400, -1, 1); AddStrucMember(id,"LpcReceivedMsgIdValid", 0x24e, 0x000400, -1, 1); AddStrucMember(id,"ActiveImpersonationInfo", 0x24f, 0x000400, -1, 1); AddStrucMember(id,"PerformanceCountHigh", 0x250, 0x20000400, -1, 4); AddStrucMember(id,"ThreadListEntry", 0x254, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); id = GetStrucIdByName("_FNSAVE_FORMAT"); AddStrucMember(id,"ControlWord", 0x0, 0x20000400, -1, 4); AddStrucMember(id,"StatusWord", 0x4, 0x20000400, -1, 4); AddStrucMember(id,"TagWord", 0x8, 0x20000400, -1, 4); AddStrucMember(id,"ErrorOffset", 0xc, 0x20000400, -1, 4); AddStrucMember(id,"ErrorSelector", 0x10, 0x20000400, -1, 4); AddStrucMember(id,"DataOffset", 0x14, 0x20000400, -1, 4); AddStrucMember(id,"DataSelector", 0x18, 0x20000400, -1, 4); AddStrucMember(id,"RegisterArea", 0x1c, 0x000400, -1, 80); id = GetStrucIdByName("_FX_SAVE_AREA::$E170318795E00A54D871FA8DA393D9F9"); AddStrucMember(id,"FnArea", 0x0, 0x60000400, GetStrucIdByName("_FNSAVE_FORMAT"), 108); AddStrucMember(id,"FxArea", 0x0, 0x60000400, GetStrucIdByName("_FXSAVE_FORMAT"), 520); id = GetStrucIdByName("_FX_SAVE_AREA"); AddStrucMember(id,"U", 0x0, 0x60000400, GetStrucIdByName("_FX_SAVE_AREA::$E170318795E00A54D871FA8DA393D9F9"), 520); AddStrucMember(id,"NpxSavedCpu", 0x208, 0x20000400, -1, 4); AddStrucMember(id,"Cr0NpxState", 0x20c, 0x20000400, -1, 4); id = GetStrucIdByName("PROCESSOR_IDLE_TIMES"); AddStrucMember(id,"StartTime", 0x0, 0x60000400, GetStrucIdByName("LARGE_INTEGER"), 8); AddStrucMember(id,"EndTime", 0x8, 0x60000400, GetStrucIdByName("LARGE_INTEGER"), 8); AddStrucMember(id,"IdleHandlerReserved", 0x10, 0x20000400, -1, 16); id = GetStrucIdByName("LARGE_INTEGER"); AddStrucMember(id,"anonymous_0", 0x0, 0x60000400, GetStrucIdByName("_LARGE_INTEGER::$837407842DC9087486FDFA5FEB63B74E"), 8); AddStrucMember(id,"u", 0x0, 0x60000400, GetStrucIdByName("_LARGE_INTEGER::$837407842DC9087486FDFA5FEB63B74E"), 8); AddStrucMember(id,"QuadPart", 0x0, 0x30000400, -1, 8); id = GetStrucIdByName("_PROCESSOR_POWER_STATE"); AddStrucMember(id,"IdleFunction", 0x0, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Idle0KernelTimeLimit", 0x4, 0x20000400, -1, 4); AddStrucMember(id,"Idle0LastTime", 0x8, 0x20000400, -1, 4); AddStrucMember(id,"IdleState", 0xc, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"LastCheck", 0x10, 0x60000400, GetStrucIdByName("LARGE_INTEGER"), 8); AddStrucMember(id,"IdleTimes", 0x18, 0x60000400, GetStrucIdByName("PROCESSOR_IDLE_TIMES"), 32); AddStrucMember(id,"IdleTime1", 0x38, 0x20000400, -1, 4); AddStrucMember(id,"PromotionCheck", 0x3c, 0x20000400, -1, 4); AddStrucMember(id,"IdleTime2", 0x40, 0x20000400, -1, 4); AddStrucMember(id,"CurrentThrottle", 0x44, 0x000400, -1, 1); AddStrucMember(id,"ThrottleLimit", 0x45, 0x000400, -1, 1); AddStrucMember(id,"Spare1", 0x46, 0x000400, -1, 2); AddStrucMember(id,"SetMember", 0x48, 0x20000400, -1, 4); AddStrucMember(id,"AbortThrottle", 0x4c, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"DebugDelta", 0x50, 0x60000400, GetStrucIdByName("LARGE_INTEGER"), 8); AddStrucMember(id,"DebugCount", 0x58, 0x20000400, -1, 4); AddStrucMember(id,"LastSysTime", 0x5c, 0x20000400, -1, 4); AddStrucMember(id,"Spare2", 0x60, 0x20000400, -1, 40); id = GetStrucIdByName("_LARGE_INTEGER::$837407842DC9087486FDFA5FEB63B74E"); AddStrucMember(id,"LowPart", 0x0, 0x20000400, -1, 4); AddStrucMember(id,"HighPart", 0x4, 0x20000400, -1, 4); id = GetStrucIdByName("_LARGE_INTEGER"); AddStrucMember(id,"anonymous_0", 0x0, 0x60000400, GetStrucIdByName("_LARGE_INTEGER::$837407842DC9087486FDFA5FEB63B74E"), 8); AddStrucMember(id,"u", 0x0, 0x60000400, GetStrucIdByName("_LARGE_INTEGER::$837407842DC9087486FDFA5FEB63B74E"), 8); AddStrucMember(id,"QuadPart", 0x0, 0x30000400, -1, 8); id = GetStrucIdByName("_LIST_ENTRY"); AddStrucMember(id,"Flink", 0x0, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Blink", 0x4, 0x25500400, 0xffffffff, 4); id = GetStrucIdByName("_PP_LOOKASIDE_LIST"); AddStrucMember(id,"P", 0x0, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"L", 0x4, 0x25500400, 0xffffffff, 4); id = GetStrucIdByName("_KSPIN_LOCK_QUEUE"); AddStrucMember(id,"Next", 0x0, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Lock", 0x4, 0x25500400, 0xffffffff, 4); id = GetStrucIdByName("_DESCRIPTOR"); AddStrucMember(id,"Pad", 0x0, 0x10000400, -1, 2); AddStrucMember(id,"Limit", 0x2, 0x10000400, -1, 2); AddStrucMember(id,"Base", 0x4, 0x20000400, -1, 4); id = GetStrucIdByName("_KSPECIAL_REGISTERS"); AddStrucMember(id,"Cr0", 0x0, 0x20000400, -1, 4); AddStrucMember(id,"Cr2", 0x4, 0x20000400, -1, 4); AddStrucMember(id,"Cr3", 0x8, 0x20000400, -1, 4); AddStrucMember(id,"Cr4", 0xc, 0x20000400, -1, 4); AddStrucMember(id,"KernelDr0", 0x10, 0x20000400, -1, 4); AddStrucMember(id,"KernelDr1", 0x14, 0x20000400, -1, 4); AddStrucMember(id,"KernelDr2", 0x18, 0x20000400, -1, 4); AddStrucMember(id,"KernelDr3", 0x1c, 0x20000400, -1, 4); AddStrucMember(id,"KernelDr6", 0x20, 0x20000400, -1, 4); AddStrucMember(id,"KernelDr7", 0x24, 0x20000400, -1, 4); AddStrucMember(id,"Gdtr", 0x28, 0x60000400, GetStrucIdByName("_DESCRIPTOR"), 8); AddStrucMember(id,"Idtr", 0x30, 0x60000400, GetStrucIdByName("_DESCRIPTOR"), 8); AddStrucMember(id,"Tr", 0x38, 0x10000400, -1, 2); AddStrucMember(id,"Ldtr", 0x3a, 0x10000400, -1, 2); AddStrucMember(id,"Reserved", 0x3c, 0x20000400, -1, 24); id = GetStrucIdByName("FLOATING_SAVE_AREA"); AddStrucMember(id,"ControlWord", 0x0, 0x20000400, -1, 4); AddStrucMember(id,"StatusWord", 0x4, 0x20000400, -1, 4); AddStrucMember(id,"TagWord", 0x8, 0x20000400, -1, 4); AddStrucMember(id,"ErrorOffset", 0xc, 0x20000400, -1, 4); AddStrucMember(id,"ErrorSelector", 0x10, 0x20000400, -1, 4); AddStrucMember(id,"DataOffset", 0x14, 0x20000400, -1, 4); AddStrucMember(id,"DataSelector", 0x18, 0x20000400, -1, 4); AddStrucMember(id,"RegisterArea", 0x1c, 0x000400, -1, 80); AddStrucMember(id,"Cr0NpxState", 0x6c, 0x20000400, -1, 4); id = GetStrucIdByName("_CONTEXT"); AddStrucMember(id,"ContextFlags", 0x0, 0x20000400, -1, 4); AddStrucMember(id,"Dr0", 0x4, 0x20000400, -1, 4); AddStrucMember(id,"Dr1", 0x8, 0x20000400, -1, 4); AddStrucMember(id,"Dr2", 0xc, 0x20000400, -1, 4); AddStrucMember(id,"Dr3", 0x10, 0x20000400, -1, 4); AddStrucMember(id,"Dr6", 0x14, 0x20000400, -1, 4); AddStrucMember(id,"Dr7", 0x18, 0x20000400, -1, 4); AddStrucMember(id,"FloatSave", 0x1c, 0x60000400, GetStrucIdByName("FLOATING_SAVE_AREA"), 112); AddStrucMember(id,"SegGs", 0x8c, 0x20000400, -1, 4); AddStrucMember(id,"SegFs", 0x90, 0x20000400, -1, 4); AddStrucMember(id,"SegEs", 0x94, 0x20000400, -1, 4); AddStrucMember(id,"SegDs", 0x98, 0x20000400, -1, 4); AddStrucMember(id,"Edi", 0x9c, 0x20000400, -1, 4); AddStrucMember(id,"Esi", 0xa0, 0x20000400, -1, 4); AddStrucMember(id,"Ebx", 0xa4, 0x20000400, -1, 4); AddStrucMember(id,"Edx", 0xa8, 0x20000400, -1, 4); AddStrucMember(id,"Ecx", 0xac, 0x20000400, -1, 4); AddStrucMember(id,"Eax", 0xb0, 0x20000400, -1, 4); AddStrucMember(id,"Ebp", 0xb4, 0x20000400, -1, 4); AddStrucMember(id,"Eip", 0xb8, 0x20000400, -1, 4); AddStrucMember(id,"SegCs", 0xbc, 0x20000400, -1, 4); AddStrucMember(id,"EFlags", 0xc0, 0x20000400, -1, 4); AddStrucMember(id,"Esp", 0xc4, 0x20000400, -1, 4); AddStrucMember(id,"SegSs", 0xc8, 0x20000400, -1, 4); AddStrucMember(id,"ExtendedRegisters", 0xcc, 0x000400, -1, 512); id = GetStrucIdByName("_KPROCESSOR_STATE"); AddStrucMember(id,"ContextFrame", 0x0, 0x60000400, GetStrucIdByName("_CONTEXT"), 716); AddStrucMember(id,"SpecialRegisters", 0x2cc, 0x60000400, GetStrucIdByName("_KSPECIAL_REGISTERS"), 84); id = GetStrucIdByName("_KPRCB"); AddStrucMember(id,"MinorVersion", 0x0, 0x10000400, -1, 2); AddStrucMember(id,"MajorVersion", 0x2, 0x10000400, -1, 2); AddStrucMember(id,"CurrentThread", 0x4, 0x000400, -1, 1); AddStrucMember(id,"NextThread", 0x8, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"IdleThread", 0xc, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Number", 0x10, 0x000400, -1, 1); AddStrucMember(id,"Reserved", 0x11, 0x000400, -1, 1); AddStrucMember(id,"BuildType", 0x12, 0x10000400, -1, 2); AddStrucMember(id,"SetMember", 0x14, 0x20000400, -1, 4); AddStrucMember(id,"CpuType", 0x18, 0x000400, -1, 1); AddStrucMember(id,"CpuID", 0x19, 0x000400, -1, 1); AddStrucMember(id,"CpuStep", 0x1a, 0x10000400, -1, 2); AddStrucMember(id,"ProcessorState", 0x1c, 0x60000400, GetStrucIdByName("_KPROCESSOR_STATE"), 800); AddStrucMember(id,"KernelReserved", 0x33c, 0x20000400, -1, 64); AddStrucMember(id,"HalReserved", 0x37c, 0x20000400, -1, 64); AddStrucMember(id,"LockQueue", 0x3bc, 0x60000400, GetStrucIdByName("_KSPIN_LOCK_QUEUE"), 128); AddStrucMember(id,"NpxThread", 0x43c, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"InterruptCount", 0x440, 0x20000400, -1, 4); AddStrucMember(id,"KernelTime", 0x444, 0x20000400, -1, 4); AddStrucMember(id,"UserTime", 0x448, 0x20000400, -1, 4); AddStrucMember(id,"DpcTime", 0x44c, 0x20000400, -1, 4); AddStrucMember(id,"InterruptTime", 0x450, 0x20000400, -1, 4); AddStrucMember(id,"ApcBypassCount", 0x454, 0x20000400, -1, 4); AddStrucMember(id,"DpcBypassCount", 0x458, 0x20000400, -1, 4); AddStrucMember(id,"AdjustDpcThreshold", 0x45c, 0x20000400, -1, 4); AddStrucMember(id,"DebugDpcTime", 0x460, 0x20000400, -1, 4); AddStrucMember(id,"Spare2", 0x464, 0x20000400, -1, 16); AddStrucMember(id,"ThreadStartCount", 0x474, 0x20000400, -1, 8); AddStrucMember(id,"SpareHotData", 0x47c, 0x25500400, 0xffffffff, 8); AddStrucMember(id,"CcFastReadNoWait", 0x484, 0x20000400, -1, 4); AddStrucMember(id,"CcFastReadWait", 0x488, 0x20000400, -1, 4); AddStrucMember(id,"CcFastReadNotPossible", 0x48c, 0x20000400, -1, 4); AddStrucMember(id,"CcCopyReadNoWait", 0x490, 0x20000400, -1, 4); AddStrucMember(id,"CcCopyReadWait", 0x494, 0x20000400, -1, 4); AddStrucMember(id,"CcCopyReadNoWaitMiss", 0x498, 0x20000400, -1, 4); AddStrucMember(id,"KeAlignmentFixupCount", 0x49c, 0x20000400, -1, 4); AddStrucMember(id,"KeContextSwitches", 0x4a0, 0x20000400, -1, 4); AddStrucMember(id,"KeDcacheFlushCount", 0x4a4, 0x20000400, -1, 4); AddStrucMember(id,"KeExceptionDispatchCount", 0x4a8, 0x20000400, -1, 4); AddStrucMember(id,"KeFirstLevelTbFills", 0x4ac, 0x20000400, -1, 4); AddStrucMember(id,"KeFloatingEmulationCount", 0x4b0, 0x20000400, -1, 4); AddStrucMember(id,"KeIcacheFlushCount", 0x4b4, 0x20000400, -1, 4); AddStrucMember(id,"KeSecondLevelTbFills", 0x4b8, 0x20000400, -1, 4); AddStrucMember(id,"KeSystemCalls", 0x4bc, 0x20000400, -1, 4); AddStrucMember(id,"ReservedCounter", 0x4c0, 0x20000400, -1, 32); AddStrucMember(id,"SmallIrpFreeEntry", 0x4e0, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"LargeIrpFreeEntry", 0x4e4, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"MdlFreeEntry", 0x4e8, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"CreateInfoFreeEntry", 0x4ec, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"NameBufferFreeEntry", 0x4f0, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"SharedCacheMapEntry", 0x4f4, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"CachePad0", 0x4f8, 0x20000400, -1, 8); AddStrucMember(id,"PPLookasideList", 0x500, 0x60000400, GetStrucIdByName("_PP_LOOKASIDE_LIST"), 128); AddStrucMember(id,"PPNPagedLookasideList", 0x580, 0x60000400, GetStrucIdByName("_PP_LOOKASIDE_LIST"), 64); AddStrucMember(id,"PPPagedLookasideList", 0x5c0, 0x60000400, GetStrucIdByName("_PP_LOOKASIDE_LIST"), 64); AddStrucMember(id,"ReservedPad", 0x600, 0x000400, -1, 128); AddStrucMember(id,"CurrentPacket", 0x680, 0x25500400, 0xffffffff, 12); AddStrucMember(id,"TargetSet", 0x68c, 0x20000400, -1, 4); AddStrucMember(id,"WorkerRoutine", 0x690, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"IpiFrozen", 0x694, 0x20000400, -1, 4); AddStrucMember(id,"CachePad1", 0x698, 0x20000400, -1, 8); AddStrucMember(id,"RequestSummary", 0x6a0, 0x20000400, -1, 4); AddStrucMember(id,"SignalDone", 0x6a4, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"ReverseStall", 0x6a8, 0x20000400, -1, 4); AddStrucMember(id,"IpiFrame", 0x6ac, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"CachePad2", 0x6b0, 0x20000400, -1, 16); AddStrucMember(id,"DpcInterruptRequested", 0x6c0, 0x20000400, -1, 4); AddStrucMember(id,"ChainedInterruptList", 0x6c4, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"CachePad3", 0x6c8, 0x20000400, -1, 8); AddStrucMember(id,"MaximumDpcQueueDepth", 0x6d0, 0x20000400, -1, 4); AddStrucMember(id,"MinimumDpcRate", 0x6d4, 0x20000400, -1, 4); AddStrucMember(id,"CachePad4", 0x6d8, 0x20000400, -1, 8); AddStrucMember(id,"DpcListHead", 0x6e0, 0x60000400, GetStrucIdByName("_LIST_ENTRY"), 8); AddStrucMember(id,"DpcQueueDepth", 0x6e8, 0x20000400, -1, 4); AddStrucMember(id,"DpcRoutineActive", 0x6ec, 0x20000400, -1, 4); AddStrucMember(id,"DpcCount", 0x6f0, 0x20000400, -1, 4); AddStrucMember(id,"DpcLastCount", 0x6f4, 0x20000400, -1, 4); AddStrucMember(id,"DpcRequestRate", 0x6f8, 0x20000400, -1, 4); AddStrucMember(id,"DpcStack", 0x6fc, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"KernelReserved2", 0x700, 0x20000400, -1, 40); AddStrucMember(id,"DpcLock", 0x728, 0x20000400, -1, 4); AddStrucMember(id,"SkipTick", 0x72c, 0x000400, -1, 1); AddStrucMember(id,"VendorString", 0x72d, 0x000400, -1, 13); AddStrucMember(id,"MHz", 0x73c, 0x20000400, -1, 4); AddStrucMember(id,"FeatureBits", 0x740, 0x20000400, -1, 4); AddStrucMember(id,"UpdateSignature", 0x744, 0x60000400, GetStrucIdByName("_LARGE_INTEGER"), 8); AddStrucMember(id,"QuantumEnd", 0x74c, 0x20000400, -1, 4); AddStrucMember(id,"PowerState", 0x750, 0x60000400, GetStrucIdByName("_PROCESSOR_POWER_STATE"), 136); AddStrucMember(id,"NpxSaveArea", 0x7d8, 0x60000400, GetStrucIdByName("_FX_SAVE_AREA"), 528); id = GetStrucIdByName("_NT_TIB::$0349ADB4452EC09BEC08E2292695FBBA"); AddStrucMember(id,"FiberData", 0x0, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Version", 0x0, 0x20000400, -1, 4); id = GetStrucIdByName("_NT_TIB"); AddStrucMember(id,"ExceptionList", 0x0, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"StackBase", 0x4, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"StackLimit", 0x8, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"SubSystemTib", 0xc, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"anonymous_0", 0x10, 0x60000400, GetStrucIdByName("_NT_TIB::$0349ADB4452EC09BEC08E2292695FBBA"), 4); AddStrucMember(id,"ArbitraryUserPointer", 0x14, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Self", 0x18, 0x25500400, 0xffffffff, 4); id = GetStrucIdByName("_KPCR"); AddStrucMember(id,"NtTib", 0x0, 0x60000400, GetStrucIdByName("_NT_TIB"), 28); AddStrucMember(id,"SelfPcr", 0x1c, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Prcb", 0x20, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"Irql", 0x24, 0x000400, -1, 1); AddStrucMember(id,"IRR", 0x28, 0x20000400, -1, 4); AddStrucMember(id,"IrrActive", 0x2c, 0x20000400, -1, 4); AddStrucMember(id,"IDR", 0x30, 0x20000400, -1, 4); AddStrucMember(id,"Reserved2", 0x34, 0x20000400, -1, 4); AddStrucMember(id,"IDT", 0x38, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"GDT", 0x3c, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"TSS", 0x40, 0x25500400, 0xffffffff, 4); AddStrucMember(id,"MajorVersion", 0x44, 0x10000400, -1, 2); AddStrucMember(id,"MinorVersion", 0x46, 0x10000400, -1, 2); AddStrucMember(id,"SetMember", 0x48, 0x20000400, -1, 4); AddStrucMember(id,"StallScaleFactor", 0x4c, 0x20000400, -1, 4); AddStrucMember(id,"DebugActive", 0x50, 0x000400, -1, 1); AddStrucMember(id,"Number", 0x51, 0x000400, -1, 1); AddStrucMember(id,"VdmAlert", 0x52, 0x000400, -1, 1); AddStrucMember(id,"Reserved", 0x53, 0x000400, -1, 1); AddStrucMember(id,"KernelReserved", 0x54, 0x20000400, -1, 60); AddStrucMember(id,"SecondLevelCacheSize", 0x90, 0x20000400, -1, 4); AddStrucMember(id,"HalReserved", 0x94, 0x20000400, -1, 64); AddStrucMember(id,"InterruptMode", 0xd4, 0x20000400, -1, 4); AddStrucMember(id,"Spare1", 0xd8, 0x000400, -1, 1); AddStrucMember(id,"KernelReserved2", 0xdc, 0x20000400, -1, 68); AddStrucMember(id,"PrcbData", 0x120, 0x60000400, GetStrucIdByName("_KPRCB"), 2536); } // End of file.