Kernel-Mode Windows

https://www.geoffchappell.com/studies/windows/km
Admin
Kernel-Mode Windows is a comprehensive guide and reference on the low-level architecture, internals,...
Tokens:567,037
Snippets:8,881
Trust Score:9.6
Update:2 months ago
Show doc for...
Tokens:
Raw
### StartProcessor Function Pointer

Source: https://www.geoffchappell.com/studies/windows/km/hal/inc/ntsoc/interrupt_function_table.htm

Starts a processor.

```c
NTSTATUS 
(*StartProcessor) (
    PVOID, 
    ULONG, 
    PVOID, 
    ULONG);
```

--------------------------------

### NTSTATUS ZwStartProfile(HANDLE ProfileHandle)

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/profile/start.htm

Starts the profiling that has been configured for a given profile object.

```APIDOC
## ZwStartProfile

### Description
Starts the profiling that has been configured for a given profile object.

### Signature
`NTSTATUS NtStartProfile (HANDLE ProfileHandle);`

### Parameters
- **ProfileHandle** (HANDLE) - Required - A handle to an executive profile object, such as created by NtCreateProfile or NtCreateProfileEx.

### Return Value
Returns STATUS_SUCCESS if successful, else a negative error code.
```

--------------------------------

### HalTimerWatchdogStart Function Pointer Variants

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/hal/hal_private_dispatch.htm

Function pointer definitions for starting the timer watchdog.

```C
NTSTATUS
(*HalTimerWatchdogStart) (
    VOID);
```

```C
VOID 
(*HalTimerWatchdogStart) (
    VOID);
```

--------------------------------

### Execute Profiling Command

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/profile/demo.htm

Command-line examples for running the profiling tool to compare performance between unsorted and sorted input buffers.

```text
J:\TEMP>profile /bucketsize:4 /source:0 /runs:100000
Interval for source 0 is 0x00009897
Times for 100000 runs are 41.824 and 6.880 seconds
Offset        Unsorted     Sorted
0x00000000:          0          0
0x00000004:          0          0
0x00000008:          0          0
0x0000000C:          0          0
0x00000010:        837        843
0x00000014:       2011         16
0x00000018:       1244        196
0x0000001C:       3158        695
0x00000020:       2972          0
0x00000024:        449          9
0x00000028:          0          0
0x0000002C:          0          0
            ========== ==========
                 10671       1759
```

```text
J:\TEMP>profile /bucketsize:4 /source:0 /runs:100000
Interval for source 0 is 0x00009897
Times for 100000 runs are 41.871 and 6.880 seconds
Offset        Unsorted     Sorted
0x00000000:          0          0
0x00000004:          0          0
0x00000008:          0          0
0x0000000C:          0          0
0x00000010:        853        841
0x00000014:       2047         14
0x00000018:       1254        183
0x0000001C:       3116        707
0x00000020:       2979          0
0x00000024:        415         11
0x00000028:          0          0
0x0000002C:          0          0
            ========== ==========
                 10664       1756
```

--------------------------------

### Command Prompt Directory Locking Example

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/pebteb/curdir.htm

Demonstrates how an open handle to a current directory prevents directory removal.

```batch
md path\test
cd path\test
notepad
cd ..
rd test
```

--------------------------------

### RtlTreeFindInsertLocation Implementation

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/shared/ntdef/rtl_balanced_node.htm

Example implementation of the RtlTreeFindInsertLocation inline routine used to determine the insertion point for a new node in a balanced tree.

```c
FORCEINLINE
PRTL_BALANCED_NODE 
RtlTreeFindInsertLocation (
    PRTL_BALANCED_NODE Root,
    PVOID Context,
    PRTL_TREE_COMPARE_FUNCTION Callback,
    BOOLEAN *Right)
{
    PRTL_BALANCED_NODE node, next;

    *Right = FALSE;
    for (node = Root; node != NULL; node = next) {
        LONG cmp = Callback (Context, node);
        if (cmp < 0) {
            next = node -> Left;
            if (next == NULL) {
                *Right = FALSE;
                break;
            }
        }
        else {
            next = node -> Right;
            if (next == NULL) {
                *Right = TRUE;
                break;
            }
        }
    }
    return node;
}
```

--------------------------------

### Custom Spin Loop Implementation

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ke/spinlock/test.htm

Example of using KeTestSpinLock within a custom spin loop to perform work while waiting for a spin lock at DISPATCH_LEVEL.

```c
while (!KeTryToAcquireSpinLockAtDpcLevel (SpinLock)) {
    do {
        /*  do custom work at DPC level  */
    } while (!KeTestSpinLock (SpinLock));
}
```

--------------------------------

### Driver Compatibility Database XML Structure

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/kshim/ksecore/index.htm

Example of how drivers are defined within the DRVMAIN.SDB file, specifying platform, version constraints, and associated shims.

```xml
<?xml version="1.0" encoding="UTF-16"?>
<DATABASE NAME="Microsoft Driver Compatibility Database" ID="{F9AB2228-3312-4A73-B6F9-936D70E112EF}">
...
    <DRIVER NAME="ACFDCP" VENDOR="Conexant Systems, Inc.">
        <KDRIVER NAME="ACFDCP32.sys" ID="{352D0556-1B85-4170-8E23-474B73A3AF0D}" RUNTIME_PLATFORM="X86" UPTO_BIN_PRODUCT_VERSION="1.0.23.0">
            <KSHIM NAME="usbshim" COMMAND_LINE="null" />
        </KDRIVER>
        <KDRIVER NAME="ACFDCP64.sys" ID="{CCEDF5B1-B335-4A7F-9F9B-30A0ADD576F7}" RUNTIME_PLATFORM="AMD64" UPTO_BIN_PRODUCT_VERSION="1.0.23.0">
            <KSHIM NAME="usbshim" COMMAND_LINE="null" />
        </KDRIVER>
    </DRIVER>
    <DRIVER NAME="Defragmentation Support Driver" VENDOR="Raxco Software. Inc">
        <KDRIVER NAME="DefragFS.sys" ID="{CF73631A-E65A-4C69-BBE5-94D3CE271ED1}" RUNTIME_PLATFORM="X86,AMD64" UPTO_BIN_PRODUCT_VERSION="8.0.0">
            <KSHIM NAME="KmWin81VersionLie" />
        </KDRIVER>
    </DRIVER>
    <DRIVER NAME="Franklin U600 Driver" VENDOR="Franklin Wireless Corp.">
        <KDRIVER NAME="DIFMBUS.sys" ID="{E9B89614-E29D-4963-BCDE-16F699DD8D0E}" RUNTIME_PLATFORM="X86,AMD64" UPTO_BIN_PRODUCT_VERSION="1.2">
            <KSHIM NAME="KmWin7VersionLie" />
        </KDRIVER>
        <KDRIVER NAME="DIFMCVsp.sys" ID="{68EACE63-BC0D-4C77-A3BA-A181DB5B7B71}" RUNTIME_PLATFORM="X86,AMD64" UPTO_BIN_PRODUCT_VERSION="1.2">
            <KSHIM NAME="KmWin7VersionLie" />
        </KDRIVER>
        <KDRIVER NAME="DIFMMdm.sys" ID="{69FDAC73-3599-4D51-96A9-B92FBB78A7A2}" RUNTIME_PLATFORM="X86,AMD64" UPTO_BIN_PRODUCT_VERSION="1.2">
            <KSHIM NAME="KmWin7VersionLie" />
        </KDRIVER>
        <KDRIVER NAME="DIFMNVsp.sys" ID="{6F8FCCC6-C15D-42E7-A942-48A45347A31B}" RUNTIME_PLATFORM="X86,AMD64" UPTO_BIN_PRODUCT_VERSION="1.2">
            <KSHIM NAME="KmWin7VersionLie" />
        </KDRIVER>
        <KDRIVER NAME="DIFMVsp.sys" ID="{CFD4D651-4C66-4313-A992-2B7BE51F7DEF}" RUNTIME_PLATFORM="X86,AMD64" UPTO_BIN_PRODUCT_VERSION="1.2">
            <KSHIM NAME="KmWin7VersionLie" />
        </KDRIVER>
```

--------------------------------

### Define EVENT_TRACE_HEADER TimeStamp and GUID

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/shared/evntrace/event_trace_header.htm

Represents the timestamp and GUID union at offsets 0x10 and 0x18.

```C
LARGE_INTEGER TimeStamp;
```

```C
union {
    GUID Guid;
    ULONGLONG GuidPtr;
};
```

--------------------------------

### Main Profiling Logic

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/profile/procrash.cpp.htm

Parses command line arguments to select a demonstration mode and initializes the profiling object via NtCreateProfile.

```cpp
int __cdecl wmain (int argc, PWSTR *argv)
{
    /*  Parse the command line to learn which coding error to demonstrate.  */

    int demo = 0;

    if (argc == 0) return -1;

    while (++ argv, -- argc != 0) {
        PWSTR arg = *argv;
        if (demo == 0) {
            if (wcscmp (arg, L"1") == 0) {
                demo = 1;
                continue;
            }
            if (wcscmp (arg, L"2") == 0) {
                demo = 2;
                continue;
            }
        }
        printf ("Invalid parameter %ws\n", arg);
        return -1;
    }

    if (demo == 0) demo = 1;

    /*  From the Buffer that we set aside above, carve out the BUFFER_SIZE 
        bytes that we'll provide for the execution counts. Remember, the
        distinctive property we want is that these BUFFER_SIZE bytes end at 
        a page boundary.  */

    PBYTE end = (PBYTE) ALIGN_UP_BY (Buffer + BUFFER_SIZE, PAGE_SIZE);
    ULONG *buffer = (ULONG *) (end - BUFFER_SIZE);

    /*  The two demonstrations choose the profiled region ever so slightly 
        differently.  */

    ULONG logbucketsize;
    PVOID profilebase;
    ULONG profilesize;

    if (demo == 1) {

        logbucketsize = LOG_BUCKET_SIZE_1;

        /*  For the ancient defect, place the whole of the ProfileLoop in 
            our mischievous excess.  */

        profilebase = (PBYTE) ProfileLoop - PROFILE_SIZE_1;
        profilesize = PROFILE_SIZE_1 + PROFILE_EXCESS;
    }
    else {

        logbucketsize = LOG_BUCKET_SIZE_2;

        /*  For demonstration 2, contrive to get the profiled region ending 
            at exactly an instruction in the loop.  */

        PVOID endprofile;
        ProfileLoop (1, &endprofile);

        profilebase = (PBYTE) endprofile - PROFILE_SIZE_2;
        profilesize = PROFILE_SIZE_2;
    }

    /*	Set up the profiling of execution in the profiled region. 
    
        By the way, the simplicity of passing -1 to stand for profiling all 
        processors comes with a small burden on 64-bit Windows: we must run 
        a 64-bit build, not a 32-bit build, else the -1 is interpreted as 
        meaning to profile the first 32 processors and NtCreateProfile fails
        unless there actually are 32 active processors to profile.  */

    HANDLE hprofile;
    NTSTATUS status = NtCreateProfile (
        &hprofile,
        GetCurrentProcess (),
        profilebase,
        profilesize,
        logbucketsize,
        buffer,
        BUFFER_SIZE,
        ProfileTime,
        (KAFFINITY) -1);
    if (!NT_SUCCESS (status)) {
        printf ("Error 0x%08X creating profile object\n", (UINT32) status);
    }
    else {

        /*  Start the profiling and run the loop.  */

        status = NtStartProfile (hprofile);
        if (!NT_SUCCESS (status)) {
            printf ("Error 0x%08X starting profile\n", (UINT32) status);
        }
        else {

            PVOID p;
            ProfileLoop (MAXUINT, &p);
```

--------------------------------

### HAL_DISPATCH Member Definition Example

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/hal/hal_dispatch.htm

Example of a member definition within the HAL_DISPATCH structure as referenced in Microsoft documentation.

```c
pHalQuerySystemInformation HalQuerySystemInformation;
```

--------------------------------

### Build commands for the demonstration

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/source/typeinfo.htm

Commands to compile and link the project with debug information enabled.

```bash
cd build
```

```bash
cl /c /Gy /Oxs /W4 /Zi main.c test.c
```

```bash
link /debug /incremental:no /opt:ref /out:test.exe /release main.obj test.obj
```

--------------------------------

### Cursor Override Start Time

Source: https://www.geoffchappell.com/studies/windows/km/win32k/structs/processinfo/index.htm

Timestamp for cursor override.

```c
ULONG timeStartCursorOverride;
```

--------------------------------

### Run Profile Demonstration

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/profile/demo.htm

Executes the profile utility with specific bucket size, interval, source, and run count parameters to measure performance impact.

```text
J:\TEMP>profile /bucketsize:4 /interval:0x04c5 /source:0 /runs:100000
Interval for source 0 is 0x00009897
Interval for source 0 changed to 0x000004C5
Times for 100000 runs are 42.495 and 7.004 seconds
Offset        Unsorted     Sorted
0x00000000:          0          0
0x00000004:          1          1
0x00000008:          0          0
0x0000000C:          0          0
0x00000010:      27461      27590
0x00000014:      66238        409
0x00000018:      40129       6172
0x0000001C:     102608      22629
0x00000020:      95943         11
0x00000024:      14746        353
0x00000028:          0          0
0x0000002C:          0          0
            ========== ==========
                347126      57165
```

--------------------------------

### WorkingSetListIndirectHashStart Member

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/mi/mi_system_va_state.htm

Pointer to the start of the indirect working set list hash.

```C
MMWSLE_NONDIRECT_HASH *WorkingSetListIndirectHashStart;
```

--------------------------------

### Main entry point in MAIN.C

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/source/typeinfo.htm

Simple main function that instantiates and destroys a TEST object.

```c
#include "test.h"

void __cdecl main (void)
{
    TEST *p = CreateTest ();
    if (p != NULL) DestroyTest (p);
}
```

--------------------------------

### HalDpGetInterruptReplayState Function Pointer

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/hal/hal_private_dispatch.htm

Function pointer for getting interrupt replay state.

```c
NTSTATUS
(*HalDpGetInterruptReplayState) (
    PVOID,
    PVOID *);
```

--------------------------------

### User Startup Information

Source: https://www.geoffchappell.com/studies/windows/km/win32k/structs/processinfo/index.htm

Structure containing user startup information.

```c
USERSTARTUPINFO usi;
```

--------------------------------

### System Pointers and Support Structures

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/amd64_x/kprcb/index.htm

Pointers and support structures for hypervisor, WHEA, and ETW functionality.

```C
PVOID HyperPte;
```

```C
PVOID WheaInfo;
```

```C
PVOID EtwSupport;
```

```C
SLIST_HEADER InterruptObjectPool;
```

```C
PVOID ExSaPageArray;
```

```C
LARGE_INTEGER HypercallPagePhysical;
```

```C
SLIST_HEADER HypercallPageList;
```

--------------------------------

### Idle Resiliency Start Event Description

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/events/microsoft-windows-kernel-power.htm

Plain-language description for Event ID 118.

```text
Idle resiliency activiated with requested clock period: RequestedResolution(Internal flags:Flags, Ticks:Ticks).
```

--------------------------------

### Define RootDirectory

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/mi/mi_partition_core.htm

Handle to the root directory for the partition.

```c
HANDLE RootDirectory;
```

--------------------------------

### NT_TIB Overlay Members

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/amd64_x/kpcr.htm

Members of the unnamed structure overlaying the NT_TIB at the start of the KPCR.

```C
KGDTENTRY64 *GdtBase;
```

```C
KTSS64 *TssBase;
```

```C
PVOID PerfGlobalGroupMask;
```

```C
ULONG64 UserRsp;
```

```C
KPCR *Self;
```

```C
KPRCB *CurrentPrcb;
```

```C
KSPIN_LOCK_QUEUE *LockArray;
```

```C
PVOID Used_Self;
```

--------------------------------

### Boundary Condition Logic in KeProfileInterruptWithSource

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/profile/bugdemo.htm

Comparison of the correct boundary check used in older Windows versions versus the flawed logic introduced in Windows 8.

```c
if (start <= p && p < end) /* increment */
```

```c
if (p < start || p > end) /* skip */
```

--------------------------------

### TimeZoneBiasEffective Definitions

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntexapi_x/kuser_shared_data/index.htm

Definitions for time zone bias effective start and end fields.

```c
LARGE_INTEGER TimeZoneBiasEffectiveStart;
```

```c
LARGE_INTEGER TimeZoneBiasEffectiveEnd;
```

--------------------------------

### Windows 10 Appended Members

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm

Members added to the structure starting with Windows 10.

```c
UNICODE_STRING ManufacturingProfile;
```

```c
PVOID BbtBuffer;
```

```c
ULONG64 XsaveAllowedFeatures;
```

```c
ULONG XsaveFlags;
```

```c
PVOID BootOptions;
```

```c
ULONG IumEnablement;
```

```c
ULONG IumPolicy;
```

--------------------------------

### Windows Vista Appended Members

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm

Members added to the structure starting with Windows Vista.

```C
struct {
    /*  changing bit fields, see below  */
};
```

```C
LOADER_PERFORMANCE_DATA *LoaderPerformanceData;
```

```C
LOADER_PERFORMANCE_DATA LoaderPerformanceData;
```

```C
LIST_ENTRY BootApplicationPersistentData;
```

```C
PVOID WmdTestResult;
```

```C
GUID BootIdentifier;
```

--------------------------------

### Windows XP Appended Members

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm

Members added to the structure starting with Windows XP.

```C
ULONG_PTR LoaderPagesSpanned;
```

```C
HEADLESS_LOADER_BLOCK *HeadlessLoaderBlock;
```

```C
SMBIOS_TABLE_HEADER *SMBiosEPSHeader;
```

```C
SMBIOS3_TABLE_HEADER *SMBiosEPSHeader;
```

```C
PVOID DrvDBImage;
```

```C
ULONG DrvDBSize;
```

```C
PVOID DrvDBPatchImage;
```

```C
ULONG DrvDBPatchSize;
```

```C
NETWORK_LOADER_BLOCK *NetworkLoaderBlock;
```

--------------------------------

### Display !strct command syntax

Source: https://www.geoffchappell.com/studies/windows/km/debug/kdex2x86/strct.htm

Shows the usage pattern for the !strct command as provided by the extension's !help output.

```text
strct [-?h] <structname/"load"/"unload"> [fieldname] [expression]
                           - Display member offset and structure data
```

--------------------------------

### VOID IoInitializeIrpEx(IRP *Irp, DEVICE_OBJECT *DeviceObject, USHORT PacketSize, CHAR StackSize)

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/io/iosubs/initializeirpex.htm

Initializes caller-supplied memory for use as an I/O Request Packet (IRP).

```APIDOC
## VOID IoInitializeIrpEx(IRP *Irp, DEVICE_OBJECT *DeviceObject, USHORT PacketSize, CHAR StackSize)

### Description
Initializes caller-supplied memory for use as an I/O Request Packet (IRP). This function is an elaboration of IoInitializeIrp, providing support for device objects that require IRP extensions.

### Parameters
- **Irp** (IRP*) - The address at which to prepare the IRP and supporting structures.
- **DeviceObject** (DEVICE_OBJECT*) - The address of a DEVICE_OBJECT representing the target device. Can be NULL.
- **PacketSize** (USHORT) - The number of bytes available at the address given by Irp.
- **StackSize** (CHAR) - The number of I/O stack locations to provide for the IRP.

### Return Value
This function returns nothing (VOID).
```

--------------------------------

### Single-Line Synchronization Comment

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/source/inc/index.htm

Example of a single-line comment used to indicate that a definition is shared with WINNT.H.

```c
typedef ULONG KSPIN_LOCK;  // winnt
```

--------------------------------

### SystemCpuQuotaInformation (0x71)

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/set.htm

Configures CPU quota information. Requires DFSS to be enabled and SeIncreaseQuotaPrivilege for user-mode callers.

```APIDOC
## SystemCpuQuotaInformation (0x71)

### Description
Configures CPU quota settings using an array of PS_CPU_QUOTA_SET_INFORMATION structures.

### Parameters
- **InformationBuffer** (PS_CPU_QUOTA_SET_INFORMATION[]) - Required - A non-empty array of structures.

### Requirements
- **Configuration** - DFSS must be enabled via registry.
- **Privilege** - SeIncreaseQuotaPrivilege (for user-mode requests).
```

--------------------------------

### RTL_CONSTANT_STRING Usage Quirks

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/rtl/string/initunicodestring.htm

Examples of incorrect usage of RTL_CONSTANT_STRING that may compile without warnings.

```C
PCWSTR Pointer = L"String";
UNICODE_STRING UnicodeString = RTL_CONSTANT_STRING (Pointer);
```

```C
UNICODE_STRING UnicodeString = RTL_CONSTANT_STRING ((PWSTR) NULL);
```

--------------------------------

### NtBuildLabEx Member

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm

Extended build lab string, available in version 1703 and higher.

```C
CHAR NtBuildLabEx [0xE0];
```

--------------------------------

### Initialize UNICODE_STRING with RTL_CONSTANT_STRING

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/rtl/string/initunicodestring.htm

Examples of using RTL_CONSTANT_STRING to initialize UNICODE_STRING structures with constant strings.

```C
DECLSPEC_SELECTANY
extern UNICODE_STRING const UnicodeString = RTL_CONSTANT_STRING (L"String");
```

```C
static WCHAR const String [] = L"String";
static UNICODE_STRING const UnicodeString = RTL_CONSTANT_STRING (String);
```

```C
DECLSPEC_SELECTANY 
extern WCHAR const String [] = L"String";
static UNICODE_STRING UnicodeString = RTL_CONSTANT_STRING (String);
```

--------------------------------

### KUSER_SHARED_DATA TraceLogging and Flags

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntexapi_x/kuser_shared_data/index.htm

Definitions for TraceLogging and shared data flags starting at offset 0x02F0.

```C
ULONG TraceLogging;
```

```C
union {
    ULONG SharedDataFlags;
    struct {
        /*  slightly changing bit fields, follow link  */
    };
};
```

--------------------------------

### Activation Context and Patch Information

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntldr/ldr_data_table_entry/index.htm

Definitions for entry point activation context and patch information or related fields.

```C
PVOID EntryPointActivationContext;
```

```C
PVOID PatchInformation;
```

```C
PVOID Spare;
```

```C
PVOID Lock;
```

--------------------------------

### Activation Context Stack and Instrumentation Definitions (x64)

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/pebteb/teb/index.htm

Definitions for the ActivationContextStack pointer and instrumentation callback members on x64 architectures.

```c
ACTIVATION_CONTEXT_STACK *ActivationContextStackPointer;
```

```c
ULONG_PTR InstrumentationCallbackSp;
```

```c
ULONG_PTR InstrumentationCallbackPreviousPc;
```

```c
ULONG_PTR InstrumentationCallbackPreviousSp;
```

```c
BOOLEAN InstrumentationCallbackDisabled;
```

```c
BOOLEAN UnalignedLoadStoreExceptions;
```

--------------------------------

### Windows 8.1 Appended Members

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm

Members added to the structure starting with Windows 8.1 (6.3).

```c
DEBUG_DEVICE_DESCRIPTOR *KdDebugDevice;
```

```c
OFFLINE_CRASHDUMP_CONFIGURATION_TABLE OfflineCrashdumpConfigurationTable;
```

--------------------------------

### InstanceGuid and Padding Definitions

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntwmi/wmi_buffer_header/index.htm

Definitions for the InstanceGuid or Padding1 fields at offset 0x38.

```c
GUID InstanceGuid;
```

```c
ULONG Padding1 [4];
```

--------------------------------

### MMMOD_WRITER_MDL_ENTRY Flags

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/mm/modwrite/mmmod_writer_mdl_entry.htm

Bit field definitions for the flags used in the structure starting from Windows 8.

```C
ULONG KeepForever : 1;
```

```C
ULONG Networked : 1;
```

```C
ULONG IoPriority : 3;
```

```C
ULONG ModifiedStoreWrite : 1;
```

--------------------------------

### XState Configuration Definition

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntexapi_x/kuser_shared_data/index.htm

Definition for the XState configuration structure.

```c
XSTATE_CONFIGURATION XState;
```

--------------------------------

### Virtual Address Union

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/bigpool_entry.htm

Defines the virtual address or non-paged status bit at the start of the structure.

```c
union {
    PVOID VirtualAddress;
    ULONG_PTR NonPaged : 1;
};
```

--------------------------------

### KPRCB Members Added in Windows 8.1

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/i386_x/kprcb/index.htm

Members appended to the KPRCB structure starting with Windows 8.1.

```c
PVOID IsrStack;
```

```c
KINTERRUPT *VectorToInterruptObject [0xD0];
```

```c
SINGLE_LIST_ENTRY AbSelfIoBoostsList;
```

```c
SINGLE_LIST_ENTRY AbPropagateBoostsList;
```

```c
KDPC AbDpc;
```

--------------------------------

### KEXECUTE_OPTIONS Structure Definition (5.2 to 6.0)

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/ke/kexecute_options.htm

Initial structure definition used in Windows versions from late 5.2 to 6.0.

```c
typedef struct _KEXECUTE_OPTIONS {      // late 5.2 to 6.0
    /*  bit fields, see below  */
} KEXECUTE_OPTIONS;
```

--------------------------------

### KUSER_SHARED_DATA TickCount and Cookie

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntexapi_x/kuser_shared_data/index.htm

Definitions for system tick counts and security cookies starting at offset 0x0320.

```C
union {
    KSYSTEM_TIME volatile TickCount;
    ULONG64 volatile TickCountQuad;
};
```

```C
union {
    KSYSTEM_TIME volatile TickCount;
    ULONG64 volatile TickCountQuad;
    struct {
        ULONG ReservedTickCountOverlay [3];
        ULONG TickCountPad [1];
    };
};
```

```C
ULONG Cookie;
```

--------------------------------

### Environment and Callback Definitions

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/pebteb/peb/index.htm

Definitions for environment update counts, flags, and kernel callback tables.

```C
ULONG EnvironmentUpdateCount;
```

```C
union {
    ULONG CrossProcessFlags;
    struct {
        /*  bit fields, follow link  */
    };
};
```

```C
UCHAR Padding1 [4];
```

```C
PVOID KernelCallbackTable;
```

```C
union {
```

--------------------------------

### PPM_ETW_QUICK_CAP_INFO Event Description

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/events/microsoft-windows-kernel-processor-power.htm

Plain-language description for the QuickCapInfo event.

```text
The speed of processor Number in group Group is being limited by system firmware. The processor has been in this reduced performance state for CapDurationInSeconds seconds since the last report.
```

--------------------------------

### Windows Server 2003 Appended Members

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm

Members added to the structure starting with Windows Server 2003.

```C
PUCHAR HalpIRQLToTPR;
```

```C
PUCHAR HalpVectorToIRQL;
```

```C
LIST_ENTRY FirmwareDescriptorListHead;
```

```C
PVOID AcpiTable;
```

```C
ULONG AcpiTableSize;
```

--------------------------------

### Header Synchronization Markers

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/source/inc/index.htm

Example of using begin/end comments to mark code blocks shared between NTDDK.H and WINNT.H.

```c
// begin_winnt
#define MAXIMUM_WAIT_OBJECTS 64     // Maximum number of wait objects

#define MAXIMUM_SUSPEND_COUNT MAXCHAR // Maximum times thread can be suspended
// end_winnt
```

--------------------------------

### NtBuildLab Member

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm

Build lab string, available in version 1703 and higher.

```C
CHAR NtBuildLab [0xE0];
```

--------------------------------

### Define _CELL_DATA structure in C

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/source/inc/cmdata.htm

Example of structure nesting within _CELL_DATA as inferred from kernel symbol files.

```c
typedef struct _CELL_DATA {
    union _u {
        /*  members omitted  */
    } u;
} CELL_DATA;
```

--------------------------------

### NtOpenPartition

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/mm/partition/open.htm

Opens a handle to a memory partition.

```APIDOC
## NtOpenPartition

### Description
Opens a memory partition and returns a handle to it.

### Signature
NTSTATUS NtOpenPartition (HANDLE *PartitionHandle, ULONG DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes);

### Parameters
- **PartitionHandle** (HANDLE *) - Address of a variable to receive the handle to the opened partition.
- **DesiredAccess** (ULONG) - Access mask of rights (e.g., MEMORY_PARTITION_QUERY_ACCESS, MEMORY_PARTITION_MODIFY_ACCESS).
- **ObjectAttributes** (POBJECT_ATTRIBUTES) - Specifies the name and properties for the partition.

### Return Value
Returns STATUS_SUCCESS on success, or a negative error code on failure.
```

--------------------------------

### Load Reason and Hash Information

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntldr/ldr_data_table_entry/index.htm

Definitions for base name hash and DLL load reason.

```C
ULONG BaseNameHashValue;
```

```C
LDR_DLL_LOAD_REASON LoadReason;
```

--------------------------------

### StartCycles Definition

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/i386_x/kprcb/index.htm

Definition for StartCycles.

```C
ULONGLONG StartCycles;
```

--------------------------------

### KPRCB Architecturally Defined Section Members

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/amd64_x/kprcb/index.htm

Definitions for the stable, architecturally defined members at the start of the KPRCB structure.

```c
ULONG MxCsr;
```

```c
UCHAR Number;
```

```c
USHORT Number;
```

```c
UCHAR LegacyNumber;
```

```c
UCHAR NestingLevel;
```

```c
UCHAR ReservedMustBeZero;
```

```c
BOOLEAN InterruptRequest;
```

```c
BOOLEAN IdleHalt;
```

```c
KTHREAD *CurrentThread;
```

```c
KTHREAD *NextThread;
```

```c
KTHREAD *IdleThread;
```

--------------------------------

### Windows NT 4.0 TEB Additions

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/pebteb/teb/index.htm

Definitions for members added or modified starting with Windows NT 4.0.

```C
ULONG HardErrorsAreDisabled;
```

```C
ULONG HardErrorMode;
```

```C
UCHAR Padding4 [4];
```

```C
PVOID Instrumentation [0x10];
```

```C
PVOID Instrumentation [0x0E];
```

```C
PVOID Instrumentation [0x09];
```

```C
PVOID Instrumentation [0x0B];
```

```C
GUID ActivityId;
```

```C
PVOID SubProcessTag;
```

```C
PVOID EtwLocalData;
```

```C
PVOID PerflibData;
```

```C
PVOID EtwTraceData;
```

--------------------------------

### Process and Activation Context Fields

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/pebteb/teb/index.htm

Fields for proxied process identification and activation context stacks.

```C
DWORD ProxiedProcessId;
```

```C
ACTIVATION_CONTEXT_STACK ActivationStack;
```

--------------------------------

### Windows 8 and Later Extension Members

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm

Definitions of members added to the LOADER_PARAMETER_EXTENSION structure starting with Windows 8.

```c
LOADER_PARAMETER_HYPERVISOR_EXTENSION HypervisorExtension;
```

```c
GUID HardwareConfigurationId;
```

```c
LIST_ENTRY HalExtensionModuleList;
```

```c
LARGE_INTEGER SystemTime;
```

```c
ULONGLONG TimeStampAtSystemTimeRead;
```

```c
ULONGLONG BootFlags;
```

```c
union {
    ULONGLONG BootFlags;
    struct {
        /*  changing bit fields, follow link  */
    };
};
```

```c
ULONGLONG InternalBootFlags;
```

```c
union {
    ULONGLONG InternalBootFlags;
    struct {
        /*  bit fields, follow link  */
    };
};
```

--------------------------------

### SubSystemVersion Union (3.10 to 3.50)

Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntmmapi/section_image_information/index.htm

Subsystem version union for Windows 3.10 to 3.50.

```C
union {
    struct {
        USHORT SubSystemMajorVersion;
        USHORT SubSystemMinorVersion;
    };
    ULONG SubSystemVersion;
};
```
Tokens:
Raw