### StartProcessor Function Pointer Source: https://www.geoffchappell.com/studies/windows/km/hal/inc/ntsoc/interrupt_function_table.htm Starts a processor. ```c NTSTATUS (*StartProcessor) ( PVOID, ULONG, PVOID, ULONG); ``` -------------------------------- ### NTSTATUS ZwStartProfile(HANDLE ProfileHandle) Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/profile/start.htm Starts the profiling that has been configured for a given profile object. ```APIDOC ## ZwStartProfile ### Description Starts the profiling that has been configured for a given profile object. ### Signature `NTSTATUS NtStartProfile (HANDLE ProfileHandle);` ### Parameters - **ProfileHandle** (HANDLE) - Required - A handle to an executive profile object, such as created by NtCreateProfile or NtCreateProfileEx. ### Return Value Returns STATUS_SUCCESS if successful, else a negative error code. ``` -------------------------------- ### HalTimerWatchdogStart Function Pointer Variants Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/hal/hal_private_dispatch.htm Function pointer definitions for starting the timer watchdog. ```C NTSTATUS (*HalTimerWatchdogStart) ( VOID); ``` ```C VOID (*HalTimerWatchdogStart) ( VOID); ``` -------------------------------- ### Execute Profiling Command Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/profile/demo.htm Command-line examples for running the profiling tool to compare performance between unsorted and sorted input buffers. ```text J:\TEMP>profile /bucketsize:4 /source:0 /runs:100000 Interval for source 0 is 0x00009897 Times for 100000 runs are 41.824 and 6.880 seconds Offset Unsorted Sorted 0x00000000: 0 0 0x00000004: 0 0 0x00000008: 0 0 0x0000000C: 0 0 0x00000010: 837 843 0x00000014: 2011 16 0x00000018: 1244 196 0x0000001C: 3158 695 0x00000020: 2972 0 0x00000024: 449 9 0x00000028: 0 0 0x0000002C: 0 0 ========== ========== 10671 1759 ``` ```text J:\TEMP>profile /bucketsize:4 /source:0 /runs:100000 Interval for source 0 is 0x00009897 Times for 100000 runs are 41.871 and 6.880 seconds Offset Unsorted Sorted 0x00000000: 0 0 0x00000004: 0 0 0x00000008: 0 0 0x0000000C: 0 0 0x00000010: 853 841 0x00000014: 2047 14 0x00000018: 1254 183 0x0000001C: 3116 707 0x00000020: 2979 0 0x00000024: 415 11 0x00000028: 0 0 0x0000002C: 0 0 ========== ========== 10664 1756 ``` -------------------------------- ### Command Prompt Directory Locking Example Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/pebteb/curdir.htm Demonstrates how an open handle to a current directory prevents directory removal. ```batch md path\test cd path\test notepad cd .. rd test ``` -------------------------------- ### RtlTreeFindInsertLocation Implementation Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/shared/ntdef/rtl_balanced_node.htm Example implementation of the RtlTreeFindInsertLocation inline routine used to determine the insertion point for a new node in a balanced tree. ```c FORCEINLINE PRTL_BALANCED_NODE RtlTreeFindInsertLocation ( PRTL_BALANCED_NODE Root, PVOID Context, PRTL_TREE_COMPARE_FUNCTION Callback, BOOLEAN *Right) { PRTL_BALANCED_NODE node, next; *Right = FALSE; for (node = Root; node != NULL; node = next) { LONG cmp = Callback (Context, node); if (cmp < 0) { next = node -> Left; if (next == NULL) { *Right = FALSE; break; } } else { next = node -> Right; if (next == NULL) { *Right = TRUE; break; } } } return node; } ``` -------------------------------- ### Custom Spin Loop Implementation Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ke/spinlock/test.htm Example of using KeTestSpinLock within a custom spin loop to perform work while waiting for a spin lock at DISPATCH_LEVEL. ```c while (!KeTryToAcquireSpinLockAtDpcLevel (SpinLock)) { do { /* do custom work at DPC level */ } while (!KeTestSpinLock (SpinLock)); } ``` -------------------------------- ### Driver Compatibility Database XML Structure Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/kshim/ksecore/index.htm Example of how drivers are defined within the DRVMAIN.SDB file, specifying platform, version constraints, and associated shims. ```xml ... ``` -------------------------------- ### Define EVENT_TRACE_HEADER TimeStamp and GUID Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/shared/evntrace/event_trace_header.htm Represents the timestamp and GUID union at offsets 0x10 and 0x18. ```C LARGE_INTEGER TimeStamp; ``` ```C union { GUID Guid; ULONGLONG GuidPtr; }; ``` -------------------------------- ### Main Profiling Logic Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/profile/procrash.cpp.htm Parses command line arguments to select a demonstration mode and initializes the profiling object via NtCreateProfile. ```cpp int __cdecl wmain (int argc, PWSTR *argv) { /* Parse the command line to learn which coding error to demonstrate. */ int demo = 0; if (argc == 0) return -1; while (++ argv, -- argc != 0) { PWSTR arg = *argv; if (demo == 0) { if (wcscmp (arg, L"1") == 0) { demo = 1; continue; } if (wcscmp (arg, L"2") == 0) { demo = 2; continue; } } printf ("Invalid parameter %ws\n", arg); return -1; } if (demo == 0) demo = 1; /* From the Buffer that we set aside above, carve out the BUFFER_SIZE bytes that we'll provide for the execution counts. Remember, the distinctive property we want is that these BUFFER_SIZE bytes end at a page boundary. */ PBYTE end = (PBYTE) ALIGN_UP_BY (Buffer + BUFFER_SIZE, PAGE_SIZE); ULONG *buffer = (ULONG *) (end - BUFFER_SIZE); /* The two demonstrations choose the profiled region ever so slightly differently. */ ULONG logbucketsize; PVOID profilebase; ULONG profilesize; if (demo == 1) { logbucketsize = LOG_BUCKET_SIZE_1; /* For the ancient defect, place the whole of the ProfileLoop in our mischievous excess. */ profilebase = (PBYTE) ProfileLoop - PROFILE_SIZE_1; profilesize = PROFILE_SIZE_1 + PROFILE_EXCESS; } else { logbucketsize = LOG_BUCKET_SIZE_2; /* For demonstration 2, contrive to get the profiled region ending at exactly an instruction in the loop. */ PVOID endprofile; ProfileLoop (1, &endprofile); profilebase = (PBYTE) endprofile - PROFILE_SIZE_2; profilesize = PROFILE_SIZE_2; } /* Set up the profiling of execution in the profiled region. By the way, the simplicity of passing -1 to stand for profiling all processors comes with a small burden on 64-bit Windows: we must run a 64-bit build, not a 32-bit build, else the -1 is interpreted as meaning to profile the first 32 processors and NtCreateProfile fails unless there actually are 32 active processors to profile. */ HANDLE hprofile; NTSTATUS status = NtCreateProfile ( &hprofile, GetCurrentProcess (), profilebase, profilesize, logbucketsize, buffer, BUFFER_SIZE, ProfileTime, (KAFFINITY) -1); if (!NT_SUCCESS (status)) { printf ("Error 0x%08X creating profile object\n", (UINT32) status); } else { /* Start the profiling and run the loop. */ status = NtStartProfile (hprofile); if (!NT_SUCCESS (status)) { printf ("Error 0x%08X starting profile\n", (UINT32) status); } else { PVOID p; ProfileLoop (MAXUINT, &p); ``` -------------------------------- ### HAL_DISPATCH Member Definition Example Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/hal/hal_dispatch.htm Example of a member definition within the HAL_DISPATCH structure as referenced in Microsoft documentation. ```c pHalQuerySystemInformation HalQuerySystemInformation; ``` -------------------------------- ### Build commands for the demonstration Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/source/typeinfo.htm Commands to compile and link the project with debug information enabled. ```bash cd build ``` ```bash cl /c /Gy /Oxs /W4 /Zi main.c test.c ``` ```bash link /debug /incremental:no /opt:ref /out:test.exe /release main.obj test.obj ``` -------------------------------- ### Cursor Override Start Time Source: https://www.geoffchappell.com/studies/windows/km/win32k/structs/processinfo/index.htm Timestamp for cursor override. ```c ULONG timeStartCursorOverride; ``` -------------------------------- ### Run Profile Demonstration Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/profile/demo.htm Executes the profile utility with specific bucket size, interval, source, and run count parameters to measure performance impact. ```text J:\TEMP>profile /bucketsize:4 /interval:0x04c5 /source:0 /runs:100000 Interval for source 0 is 0x00009897 Interval for source 0 changed to 0x000004C5 Times for 100000 runs are 42.495 and 7.004 seconds Offset Unsorted Sorted 0x00000000: 0 0 0x00000004: 1 1 0x00000008: 0 0 0x0000000C: 0 0 0x00000010: 27461 27590 0x00000014: 66238 409 0x00000018: 40129 6172 0x0000001C: 102608 22629 0x00000020: 95943 11 0x00000024: 14746 353 0x00000028: 0 0 0x0000002C: 0 0 ========== ========== 347126 57165 ``` -------------------------------- ### WorkingSetListIndirectHashStart Member Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/mi/mi_system_va_state.htm Pointer to the start of the indirect working set list hash. ```C MMWSLE_NONDIRECT_HASH *WorkingSetListIndirectHashStart; ``` -------------------------------- ### Main entry point in MAIN.C Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/source/typeinfo.htm Simple main function that instantiates and destroys a TEST object. ```c #include "test.h" void __cdecl main (void) { TEST *p = CreateTest (); if (p != NULL) DestroyTest (p); } ``` -------------------------------- ### HalDpGetInterruptReplayState Function Pointer Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/hal/hal_private_dispatch.htm Function pointer for getting interrupt replay state. ```c NTSTATUS (*HalDpGetInterruptReplayState) ( PVOID, PVOID *); ``` -------------------------------- ### User Startup Information Source: https://www.geoffchappell.com/studies/windows/km/win32k/structs/processinfo/index.htm Structure containing user startup information. ```c USERSTARTUPINFO usi; ``` -------------------------------- ### System Pointers and Support Structures Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/amd64_x/kprcb/index.htm Pointers and support structures for hypervisor, WHEA, and ETW functionality. ```C PVOID HyperPte; ``` ```C PVOID WheaInfo; ``` ```C PVOID EtwSupport; ``` ```C SLIST_HEADER InterruptObjectPool; ``` ```C PVOID ExSaPageArray; ``` ```C LARGE_INTEGER HypercallPagePhysical; ``` ```C SLIST_HEADER HypercallPageList; ``` -------------------------------- ### Idle Resiliency Start Event Description Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/events/microsoft-windows-kernel-power.htm Plain-language description for Event ID 118. ```text Idle resiliency activiated with requested clock period: RequestedResolution(Internal flags:Flags, Ticks:Ticks). ``` -------------------------------- ### Define RootDirectory Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/mi/mi_partition_core.htm Handle to the root directory for the partition. ```c HANDLE RootDirectory; ``` -------------------------------- ### NT_TIB Overlay Members Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/amd64_x/kpcr.htm Members of the unnamed structure overlaying the NT_TIB at the start of the KPCR. ```C KGDTENTRY64 *GdtBase; ``` ```C KTSS64 *TssBase; ``` ```C PVOID PerfGlobalGroupMask; ``` ```C ULONG64 UserRsp; ``` ```C KPCR *Self; ``` ```C KPRCB *CurrentPrcb; ``` ```C KSPIN_LOCK_QUEUE *LockArray; ``` ```C PVOID Used_Self; ``` -------------------------------- ### Boundary Condition Logic in KeProfileInterruptWithSource Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/profile/bugdemo.htm Comparison of the correct boundary check used in older Windows versions versus the flawed logic introduced in Windows 8. ```c if (start <= p && p < end) /* increment */ ``` ```c if (p < start || p > end) /* skip */ ``` -------------------------------- ### TimeZoneBiasEffective Definitions Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntexapi_x/kuser_shared_data/index.htm Definitions for time zone bias effective start and end fields. ```c LARGE_INTEGER TimeZoneBiasEffectiveStart; ``` ```c LARGE_INTEGER TimeZoneBiasEffectiveEnd; ``` -------------------------------- ### Windows 10 Appended Members Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm Members added to the structure starting with Windows 10. ```c UNICODE_STRING ManufacturingProfile; ``` ```c PVOID BbtBuffer; ``` ```c ULONG64 XsaveAllowedFeatures; ``` ```c ULONG XsaveFlags; ``` ```c PVOID BootOptions; ``` ```c ULONG IumEnablement; ``` ```c ULONG IumPolicy; ``` -------------------------------- ### Windows Vista Appended Members Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm Members added to the structure starting with Windows Vista. ```C struct { /* changing bit fields, see below */ }; ``` ```C LOADER_PERFORMANCE_DATA *LoaderPerformanceData; ``` ```C LOADER_PERFORMANCE_DATA LoaderPerformanceData; ``` ```C LIST_ENTRY BootApplicationPersistentData; ``` ```C PVOID WmdTestResult; ``` ```C GUID BootIdentifier; ``` -------------------------------- ### Windows XP Appended Members Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm Members added to the structure starting with Windows XP. ```C ULONG_PTR LoaderPagesSpanned; ``` ```C HEADLESS_LOADER_BLOCK *HeadlessLoaderBlock; ``` ```C SMBIOS_TABLE_HEADER *SMBiosEPSHeader; ``` ```C SMBIOS3_TABLE_HEADER *SMBiosEPSHeader; ``` ```C PVOID DrvDBImage; ``` ```C ULONG DrvDBSize; ``` ```C PVOID DrvDBPatchImage; ``` ```C ULONG DrvDBPatchSize; ``` ```C NETWORK_LOADER_BLOCK *NetworkLoaderBlock; ``` -------------------------------- ### Display !strct command syntax Source: https://www.geoffchappell.com/studies/windows/km/debug/kdex2x86/strct.htm Shows the usage pattern for the !strct command as provided by the extension's !help output. ```text strct [-?h] [fieldname] [expression] - Display member offset and structure data ``` -------------------------------- ### VOID IoInitializeIrpEx(IRP *Irp, DEVICE_OBJECT *DeviceObject, USHORT PacketSize, CHAR StackSize) Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/io/iosubs/initializeirpex.htm Initializes caller-supplied memory for use as an I/O Request Packet (IRP). ```APIDOC ## VOID IoInitializeIrpEx(IRP *Irp, DEVICE_OBJECT *DeviceObject, USHORT PacketSize, CHAR StackSize) ### Description Initializes caller-supplied memory for use as an I/O Request Packet (IRP). This function is an elaboration of IoInitializeIrp, providing support for device objects that require IRP extensions. ### Parameters - **Irp** (IRP*) - The address at which to prepare the IRP and supporting structures. - **DeviceObject** (DEVICE_OBJECT*) - The address of a DEVICE_OBJECT representing the target device. Can be NULL. - **PacketSize** (USHORT) - The number of bytes available at the address given by Irp. - **StackSize** (CHAR) - The number of I/O stack locations to provide for the IRP. ### Return Value This function returns nothing (VOID). ``` -------------------------------- ### Single-Line Synchronization Comment Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/source/inc/index.htm Example of a single-line comment used to indicate that a definition is shared with WINNT.H. ```c typedef ULONG KSPIN_LOCK; // winnt ``` -------------------------------- ### SystemCpuQuotaInformation (0x71) Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/set.htm Configures CPU quota information. Requires DFSS to be enabled and SeIncreaseQuotaPrivilege for user-mode callers. ```APIDOC ## SystemCpuQuotaInformation (0x71) ### Description Configures CPU quota settings using an array of PS_CPU_QUOTA_SET_INFORMATION structures. ### Parameters - **InformationBuffer** (PS_CPU_QUOTA_SET_INFORMATION[]) - Required - A non-empty array of structures. ### Requirements - **Configuration** - DFSS must be enabled via registry. - **Privilege** - SeIncreaseQuotaPrivilege (for user-mode requests). ``` -------------------------------- ### RTL_CONSTANT_STRING Usage Quirks Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/rtl/string/initunicodestring.htm Examples of incorrect usage of RTL_CONSTANT_STRING that may compile without warnings. ```C PCWSTR Pointer = L"String"; UNICODE_STRING UnicodeString = RTL_CONSTANT_STRING (Pointer); ``` ```C UNICODE_STRING UnicodeString = RTL_CONSTANT_STRING ((PWSTR) NULL); ``` -------------------------------- ### NtBuildLabEx Member Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm Extended build lab string, available in version 1703 and higher. ```C CHAR NtBuildLabEx [0xE0]; ``` -------------------------------- ### Initialize UNICODE_STRING with RTL_CONSTANT_STRING Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/rtl/string/initunicodestring.htm Examples of using RTL_CONSTANT_STRING to initialize UNICODE_STRING structures with constant strings. ```C DECLSPEC_SELECTANY extern UNICODE_STRING const UnicodeString = RTL_CONSTANT_STRING (L"String"); ``` ```C static WCHAR const String [] = L"String"; static UNICODE_STRING const UnicodeString = RTL_CONSTANT_STRING (String); ``` ```C DECLSPEC_SELECTANY extern WCHAR const String [] = L"String"; static UNICODE_STRING UnicodeString = RTL_CONSTANT_STRING (String); ``` -------------------------------- ### KUSER_SHARED_DATA TraceLogging and Flags Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntexapi_x/kuser_shared_data/index.htm Definitions for TraceLogging and shared data flags starting at offset 0x02F0. ```C ULONG TraceLogging; ``` ```C union { ULONG SharedDataFlags; struct { /* slightly changing bit fields, follow link */ }; }; ``` -------------------------------- ### Activation Context and Patch Information Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntldr/ldr_data_table_entry/index.htm Definitions for entry point activation context and patch information or related fields. ```C PVOID EntryPointActivationContext; ``` ```C PVOID PatchInformation; ``` ```C PVOID Spare; ``` ```C PVOID Lock; ``` -------------------------------- ### Activation Context Stack and Instrumentation Definitions (x64) Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/pebteb/teb/index.htm Definitions for the ActivationContextStack pointer and instrumentation callback members on x64 architectures. ```c ACTIVATION_CONTEXT_STACK *ActivationContextStackPointer; ``` ```c ULONG_PTR InstrumentationCallbackSp; ``` ```c ULONG_PTR InstrumentationCallbackPreviousPc; ``` ```c ULONG_PTR InstrumentationCallbackPreviousSp; ``` ```c BOOLEAN InstrumentationCallbackDisabled; ``` ```c BOOLEAN UnalignedLoadStoreExceptions; ``` -------------------------------- ### Windows 8.1 Appended Members Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm Members added to the structure starting with Windows 8.1 (6.3). ```c DEBUG_DEVICE_DESCRIPTOR *KdDebugDevice; ``` ```c OFFLINE_CRASHDUMP_CONFIGURATION_TABLE OfflineCrashdumpConfigurationTable; ``` -------------------------------- ### InstanceGuid and Padding Definitions Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntwmi/wmi_buffer_header/index.htm Definitions for the InstanceGuid or Padding1 fields at offset 0x38. ```c GUID InstanceGuid; ``` ```c ULONG Padding1 [4]; ``` -------------------------------- ### MMMOD_WRITER_MDL_ENTRY Flags Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/mm/modwrite/mmmod_writer_mdl_entry.htm Bit field definitions for the flags used in the structure starting from Windows 8. ```C ULONG KeepForever : 1; ``` ```C ULONG Networked : 1; ``` ```C ULONG IoPriority : 3; ``` ```C ULONG ModifiedStoreWrite : 1; ``` -------------------------------- ### XState Configuration Definition Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntexapi_x/kuser_shared_data/index.htm Definition for the XState configuration structure. ```c XSTATE_CONFIGURATION XState; ``` -------------------------------- ### Virtual Address Union Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/bigpool_entry.htm Defines the virtual address or non-paged status bit at the start of the structure. ```c union { PVOID VirtualAddress; ULONG_PTR NonPaged : 1; }; ``` -------------------------------- ### KPRCB Members Added in Windows 8.1 Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/i386_x/kprcb/index.htm Members appended to the KPRCB structure starting with Windows 8.1. ```c PVOID IsrStack; ``` ```c KINTERRUPT *VectorToInterruptObject [0xD0]; ``` ```c SINGLE_LIST_ENTRY AbSelfIoBoostsList; ``` ```c SINGLE_LIST_ENTRY AbPropagateBoostsList; ``` ```c KDPC AbDpc; ``` -------------------------------- ### KEXECUTE_OPTIONS Structure Definition (5.2 to 6.0) Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/ke/kexecute_options.htm Initial structure definition used in Windows versions from late 5.2 to 6.0. ```c typedef struct _KEXECUTE_OPTIONS { // late 5.2 to 6.0 /* bit fields, see below */ } KEXECUTE_OPTIONS; ``` -------------------------------- ### KUSER_SHARED_DATA TickCount and Cookie Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntexapi_x/kuser_shared_data/index.htm Definitions for system tick counts and security cookies starting at offset 0x0320. ```C union { KSYSTEM_TIME volatile TickCount; ULONG64 volatile TickCountQuad; }; ``` ```C union { KSYSTEM_TIME volatile TickCount; ULONG64 volatile TickCountQuad; struct { ULONG ReservedTickCountOverlay [3]; ULONG TickCountPad [1]; }; }; ``` ```C ULONG Cookie; ``` -------------------------------- ### Environment and Callback Definitions Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/pebteb/peb/index.htm Definitions for environment update counts, flags, and kernel callback tables. ```C ULONG EnvironmentUpdateCount; ``` ```C union { ULONG CrossProcessFlags; struct { /* bit fields, follow link */ }; }; ``` ```C UCHAR Padding1 [4]; ``` ```C PVOID KernelCallbackTable; ``` ```C union { ``` -------------------------------- ### PPM_ETW_QUICK_CAP_INFO Event Description Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/events/microsoft-windows-kernel-processor-power.htm Plain-language description for the QuickCapInfo event. ```text The speed of processor Number in group Group is being limited by system firmware. The processor has been in this reduced performance state for CapDurationInSeconds seconds since the last report. ``` -------------------------------- ### Windows Server 2003 Appended Members Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm Members added to the structure starting with Windows Server 2003. ```C PUCHAR HalpIRQLToTPR; ``` ```C PUCHAR HalpVectorToIRQL; ``` ```C LIST_ENTRY FirmwareDescriptorListHead; ``` ```C PVOID AcpiTable; ``` ```C ULONG AcpiTableSize; ``` -------------------------------- ### Header Synchronization Markers Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/source/inc/index.htm Example of using begin/end comments to mark code blocks shared between NTDDK.H and WINNT.H. ```c // begin_winnt #define MAXIMUM_WAIT_OBJECTS 64 // Maximum number of wait objects #define MAXIMUM_SUSPEND_COUNT MAXCHAR // Maximum times thread can be suspended // end_winnt ``` -------------------------------- ### NtBuildLab Member Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm Build lab string, available in version 1703 and higher. ```C CHAR NtBuildLab [0xE0]; ``` -------------------------------- ### Define _CELL_DATA structure in C Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/source/inc/cmdata.htm Example of structure nesting within _CELL_DATA as inferred from kernel symbol files. ```c typedef struct _CELL_DATA { union _u { /* members omitted */ } u; } CELL_DATA; ``` -------------------------------- ### NtOpenPartition Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/mm/partition/open.htm Opens a handle to a memory partition. ```APIDOC ## NtOpenPartition ### Description Opens a memory partition and returns a handle to it. ### Signature NTSTATUS NtOpenPartition (HANDLE *PartitionHandle, ULONG DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes); ### Parameters - **PartitionHandle** (HANDLE *) - Address of a variable to receive the handle to the opened partition. - **DesiredAccess** (ULONG) - Access mask of rights (e.g., MEMORY_PARTITION_QUERY_ACCESS, MEMORY_PARTITION_MODIFY_ACCESS). - **ObjectAttributes** (POBJECT_ATTRIBUTES) - Specifies the name and properties for the partition. ### Return Value Returns STATUS_SUCCESS on success, or a negative error code on failure. ``` -------------------------------- ### Load Reason and Hash Information Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntldr/ldr_data_table_entry/index.htm Definitions for base name hash and DLL load reason. ```C ULONG BaseNameHashValue; ``` ```C LDR_DLL_LOAD_REASON LoadReason; ``` -------------------------------- ### StartCycles Definition Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/i386_x/kprcb/index.htm Definition for StartCycles. ```C ULONGLONG StartCycles; ``` -------------------------------- ### KPRCB Architecturally Defined Section Members Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/ntos/amd64_x/kprcb/index.htm Definitions for the stable, architecturally defined members at the start of the KPRCB structure. ```c ULONG MxCsr; ``` ```c UCHAR Number; ``` ```c USHORT Number; ``` ```c UCHAR LegacyNumber; ``` ```c UCHAR NestingLevel; ``` ```c UCHAR ReservedMustBeZero; ``` ```c BOOLEAN InterruptRequest; ``` ```c BOOLEAN IdleHalt; ``` ```c KTHREAD *CurrentThread; ``` ```c KTHREAD *NextThread; ``` ```c KTHREAD *IdleThread; ``` -------------------------------- ### Windows NT 4.0 TEB Additions Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/pebteb/teb/index.htm Definitions for members added or modified starting with Windows NT 4.0. ```C ULONG HardErrorsAreDisabled; ``` ```C ULONG HardErrorMode; ``` ```C UCHAR Padding4 [4]; ``` ```C PVOID Instrumentation [0x10]; ``` ```C PVOID Instrumentation [0x0E]; ``` ```C PVOID Instrumentation [0x09]; ``` ```C PVOID Instrumentation [0x0B]; ``` ```C GUID ActivityId; ``` ```C PVOID SubProcessTag; ``` ```C PVOID EtwLocalData; ``` ```C PVOID PerflibData; ``` ```C PVOID EtwTraceData; ``` -------------------------------- ### Process and Activation Context Fields Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/pebteb/teb/index.htm Fields for proxied process identification and activation context stacks. ```C DWORD ProxiedProcessId; ``` ```C ACTIVATION_CONTEXT_STACK ActivationStack; ``` -------------------------------- ### Windows 8 and Later Extension Members Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/arc/loader_parameter_extension/index.htm Definitions of members added to the LOADER_PARAMETER_EXTENSION structure starting with Windows 8. ```c LOADER_PARAMETER_HYPERVISOR_EXTENSION HypervisorExtension; ``` ```c GUID HardwareConfigurationId; ``` ```c LIST_ENTRY HalExtensionModuleList; ``` ```c LARGE_INTEGER SystemTime; ``` ```c ULONGLONG TimeStampAtSystemTimeRead; ``` ```c ULONGLONG BootFlags; ``` ```c union { ULONGLONG BootFlags; struct { /* changing bit fields, follow link */ }; }; ``` ```c ULONGLONG InternalBootFlags; ``` ```c union { ULONGLONG InternalBootFlags; struct { /* bit fields, follow link */ }; }; ``` -------------------------------- ### SubSystemVersion Union (3.10 to 3.50) Source: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/inc/api/ntmmapi/section_image_information/index.htm Subsystem version union for Windows 3.10 to 3.50. ```C union { struct { USHORT SubSystemMajorVersion; USHORT SubSystemMinorVersion; }; ULONG SubSystemVersion; }; ```