Vergilius Project

https://www.vergiliusproject.com/kernels/x64
Admin
Vergilius Project provides a comprehensive reference of Windows kernel structures and internal types...
Tokens:425,157
Snippets:1,552
Trust Score:8.3
Update:1 week ago
Show doc for...
Tokens:
Raw
### _VF_DRIVER_IO_CALLBACKS structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-10/1507/_VF_DRIVER_IO_CALLBACKS

Defines the _VF_DRIVER_IO_CALLBACKS structure with function pointers for driver initialization, start I/O, unload, add device, and major function callbacks. The structure is 0x100 bytes in size.

```c
//0x100 bytes (sizeof)
struct _VF_DRIVER_IO_CALLBACKS
{
    LONG (*DriverInit)(struct _DRIVER_OBJECT* arg1, struct _UNICODE_STRING* arg2); //0x0
    VOID (*DriverStartIo)(struct _DEVICE_OBJECT* arg1, struct _IRP* arg2);  //0x8
    VOID (*DriverUnload)(struct _DRIVER_OBJECT* arg1);                      //0x10
    LONG (*AddDevice)(struct _DRIVER_OBJECT* arg1, struct _DEVICE_OBJECT* arg2); //0x18
    LONG (*MajorFunction[28])(struct _DEVICE_OBJECT* arg1, struct _IRP* arg2); //0x20
}; 
```

--------------------------------

### _ETW_GUID_ENTRY structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-10/1511/_ETW_GUID_ENTRY

Defines the _ETW_GUID_ENTRY structure with fields for GUID list, reference count, GUID, registration list, security descriptor, last enable info, provider enable info, enable info array, filter data, host silo, lock, and lock owner. The structure size is 0x190 bytes.

```c
//0x190 bytes (sizeof)
struct _ETW_GUID_ENTRY
{
    struct _LIST_ENTRY GuidList;                                            //0x0
    volatile LONGLONG RefCount;                                             //0x10
    struct _GUID Guid;                                                      //0x18
    struct _LIST_ENTRY RegListHead;                                         //0x28
    VOID* SecurityDescriptor;                                               //0x38
    union
    {
        struct _ETW_LAST_ENABLE_INFO LastEnable;                            //0x40
        ULONGLONG MatchId;                                                  //0x40
    };
    struct _TRACE_ENABLE_INFO ProviderEnableInfo;                           //0x50
    struct _TRACE_ENABLE_INFO EnableInfo[8];                                //0x70
    struct _ETW_FILTER_HEADER* FilterData;                                  //0x170
    UCHAR HostSilo;                                                         //0x178
    struct _EX_PUSH_LOCK Lock;                                              //0x180
    struct _ETHREAD* LockOwner;                                             //0x188
}; 

```

--------------------------------

### _ETW_GUID_ENTRY structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-11/23h2/_ETW_GUID_ENTRY

C structure definition for _ETW_GUID_ENTRY, 0x1a8 bytes in size. Includes GUID list entries, reference count, GUID, security descriptor, enable info arrays, and filter data.

```c
copy
//0x1a8 bytes (sizeof)
struct _ETW_GUID_ENTRY
{
    struct _LIST_ENTRY GuidList;                                            //0x0
    struct _LIST_ENTRY SiloGuidList;                                        //0x10
    volatile LONGLONG RefCount;                                             //0x20
    struct _GUID Guid;                                                      //0x28
    struct _LIST_ENTRY RegListHead;                                         //0x38
    VOID* SecurityDescriptor;                                               //0x48
    union
    {
        struct _ETW_LAST_ENABLE_INFO LastEnable;                            //0x50
        ULONGLONG MatchId;                                                  //0x50
    };
    struct _TRACE_ENABLE_INFO ProviderEnableInfo;                           //0x60
    struct _TRACE_ENABLE_INFO EnableInfo[8];                                //0x80
    struct _ETW_FILTER_HEADER* FilterData;                                  //0x180
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
}
```

```c
copy
//0x1a8 bytes (sizeof)
struct _ETW_GUID_ENTRY
{
    struct _LIST_ENTRY GuidList;                                            //0x0
    struct _LIST_ENTRY SiloGuidList;                                        //0x10
    volatile LONGLONG RefCount;                                             //0x20
    struct _GUID Guid;                                                      //0x28
    struct _LIST_ENTRY RegListHead;                                         //0x38
    VOID* SecurityDescriptor;                                               //0x48
    union
    {
        struct _ETW_LAST_ENABLE_INFO LastEnable;                            //0x50
        ULONGLONG MatchId;                                                  //0x50
    };
    struct _TRACE_ENABLE_INFO ProviderEnableInfo;                           //0x60
    struct _TRACE_ENABLE_INFO EnableInfo[8];                                //0x80
    struct _ETW_FILTER_HEADER* FilterData;                                  //0x180
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_SILODRIVERSTATE* Silo
```

--------------------------------

### _ETW_GUID_ENTRY structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-11/25h2/_ETW_GUID_ENTRY

Definition of the _ETW_GUID_ENTRY structure, 0x1a8 bytes in size, used by ETW to track GUID-based providers. Contains linked lists, a GUID, enable information arrays, and a lock. Referenced by _ETW_REG_ENTRY and _ETW_SILODRIVERSTATE.

```c
//0x1a8 bytes (sizeof)
struct _ETW_GUID_ENTRY
{
    struct _LIST_ENTRY GuidList;                                            //0x0
    struct _LIST_ENTRY SiloGuidList;                                        //0x10
    volatile LONGLONG RefCount;                                             //0x20
    struct _GUID Guid;                                                      //0x28
    struct _LIST_ENTRY RegListHead;                                         //0x38
    VOID* SecurityDescriptor;                                               //0x48
    union
    {
        struct _ETW_LAST_ENABLE_INFO LastEnable;                            //0x50
        ULONGLONG MatchId;                                                  //0x50
    };
    struct _TRACE_ENABLE_INFO ProviderEnableInfo;                           //0x60
    struct _TRACE_ENABLE_INFO EnableInfo[8];                                //0x80
    struct _ETW_FILTER_HEADER* FilterData;                                  //0x180
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_GUID_ENTRY* HostEntry;                                      //0x190
    struct _EX_PUSH_LOCK Lock;                                              //0x198
    struct _ETHREAD* LockOwner;                                             //0x1a0
}; 
```

--------------------------------

### _ETW_GUID_ENTRY structure definition (C)

Source: https://www.vergiliusproject.com/kernels/x64/windows-10/1709/_ETW_GUID_ENTRY

Defines the _ETW_GUID_ENTRY structure used in Windows 10 1703, 1709, and 1803. The structure is 0x190 bytes and includes fields for GUID management, reference counting, security, provider enable info, and filter data.

```c
//0x190 bytes (sizeof)
struct _ETW_GUID_ENTRY
{
    struct _LIST_ENTRY GuidList;                                            //0x0
    volatile LONGLONG RefCount;                                             //0x10
    struct _GUID Guid;                                                      //0x18
    struct _LIST_ENTRY RegListHead;                                         //0x28
    VOID* SecurityDescriptor;                                               //0x38
    union
    {
        struct _ETW_LAST_ENABLE_INFO LastEnable;                            //0x40
        ULONGLONG MatchId;                                                  //0x40
    };
    struct _TRACE_ENABLE_INFO ProviderEnableInfo;                           //0x50
    struct _TRACE_ENABLE_INFO EnableInfo[8];                                //0x70
    struct _ETW_FILTER_HEADER* FilterData;                                  //0x170
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x178
    struct _EX_PUSH_LOCK Lock;                                              //0x180
    struct _ETHREAD* LockOwner;                                             //0x188
};
```

--------------------------------

### Define _TRACE_LOGFILE_HEADER structure

Source: https://www.vergiliusproject.com/kernels/x64/windows-11/22h2/_TRACE_LOGFILE_HEADER

Defines the _TRACE_LOGFILE_HEADER structure used in Windows 11 21H2, 22H2, and 23H2. The structure is 0x118 bytes in size and contains fields for buffer size, version, provider version, processor count, timing information, and logging statistics. The union members allow access to version details and log instance GUID or start buffers, pointer size, events lost, and CPU speed.

```c
copy
//0x118 bytes (sizeof)
struct _TRACE_LOGFILE_HEADER
{
    ULONG BufferSize;                                                       //0x0
    union
    {
        ULONG Version;                                                      //0x4
        struct
        {
            UCHAR MajorVersion;                                             //0x4
            UCHAR MinorVersion;                                             //0x5
            UCHAR SubVersion;                                               //0x6
            UCHAR SubMinorVersion;                                          //0x7
        } VersionDetail;                                                    //0x4
    };
    ULONG ProviderVersion;                                                  //0x8
    ULONG NumberOfProcessors;                                               //0xc
    union _LARGE_INTEGER EndTime;                                           //0x10
    ULONG TimerResolution;                                                  //0x18
    ULONG MaximumFileSize;                                                  //0x1c
    ULONG LogFileMode;                                                      //0x20
    ULONG BuffersWritten;                                                   //0x24
    union
    {
        struct _GUID LogInstanceGuid;                                       //0x28
        struct
        {
            ULONG StartBuffers;                                             //0x28
            ULONG PointerSize;                                              //0x2c
            ULONG EventsLost;                                               //0x30
            ULONG CpuSpeedInMHz;                                            //0x34
        };
    };
    WCHAR* LoggerName;                                                      //0x38
    WCHAR* LogFileName;                                                     //0x40
    struct _RTL_TIME_ZONE_INFORMATION TimeZone;                             //0x48
    union _LARGE_INTEGER BootTime;                                          //0xf8
    union _LARGE_INTEGER PerfFreq;                                          //0x100
    union _LARGE_INTEGER StartTime;                                         //0x108
    ULONG ReservedFlags;                                                    //0x110
    ULONG BuffersLost;                                                      //0x114
}; 
```

--------------------------------

### Windows XP SP2 _PLUGPLAY_EVENT_BLOCK structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-xp/sp2/_PLUGPLAY_EVENT_BLOCK

Structure definition for Windows XP/Server 2003 SP2 plug-and-play event block, used in _PNP_DEVICE_EVENT_ENTRY. Contains event GUID, category, result pointer, flags, size, device object, and a union of event-specific data structures for device class, target device, installation, custom and profile notifications, power, veto, blocked driver, and invalid ID events.

```c
struct _PLUGPLAY_EVENT_BLOCK
{
    struct _GUID EventGuid;                                                 //0x0
    enum _PLUGPLAY_EVENT_CATEGORY EventCategory;                            //0x10
    ULONG* Result;                                                          //0x18
    ULONG Flags;                                                            //0x20
    ULONG TotalSize;                                                        //0x24
    VOID* DeviceObject;                                                     //0x28
    union
    {
        struct
        {
            struct _GUID ClassGuid;                                         //0x30
            USHORT SymbolicLinkName[1];                                     //0x40
        } DeviceClass;                                                      //0x30
        struct
        {
            USHORT DeviceIds[1];                                            //0x30
        } TargetDevice;                                                     //0x30
        struct
        {
            USHORT DeviceId[1];                                             //0x30
        } InstallDevice;                                                    //0x30
        struct
        {
            VOID* NotificationStructure;                                    //0x30
            USHORT DeviceIds[1];                                            //0x38
        } CustomNotification;                                               //0x30
        struct
        {
            VOID* Notification;                                             //0x30
        } ProfileNotification;                                              //0x30
        struct
        {
            ULONG NotificationCode;                                         //0x30
            ULONG NotificationData;                                         //0x34
        } PowerNotification;                                                //0x30
        struct
        {
            enum _PNP_VETO_TYPE VetoType;                                   //0x30
            USHORT DeviceIdVetoNameBuffer[1];                               //0x34
        } VetoNotification;                                                 //0x30
        struct
        {
            struct _GUID BlockedDriverGuid;                                 //0x30
        } BlockedDriverNotification;                                        //0x30
        struct
        {
            USHORT ParentId[1];                                             //0x30
        } InvalidIDNotification;                                            //0x30
    } u;                                                                    //0x30
};
```

--------------------------------

### _IO_COMPLETION_CONTEXT structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-10/1803/_IO_COMPLETION_CONTEXT

Defines the _IO_COMPLETION_CONTEXT structure with two VOID pointers, Port at offset 0x0 and Key at offset 0x8. The structure is 0x10 bytes in size.

```c
copy
//0x10 bytes (sizeof)
struct _IO_COMPLETION_CONTEXT
{
    VOID* Port;                                                             //0x0
    VOID* Key;                                                              //0x8
}; 

```

--------------------------------

### _IO_COMPLETION_CONTEXT structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-11/23h2/_IO_COMPLETION_CONTEXT

Definition of the _IO_COMPLETION_CONTEXT structure, 0x18 bytes in size, with Port at offset 0x0, Key at 0x8, and UsageCount at 0x10. Used by _FILE_OBJECT.

```c
copy
//0x18 bytes (sizeof)
struct _IO_COMPLETION_CONTEXT
{
    VOID* Port;                                                             //0x0
    VOID* Key;                                                              //0x8
    LONGLONG UsageCount;                                                    //0x10
}; 

```

--------------------------------

### ETW GUID Type Enumeration

Source: https://www.vergiliusproject.com/kernels/x64/server-2022/21h2/_ETW_GUID_TYPE

Defines the _ETW_GUID_TYPE enum with values for trace, notification, group, and max GUID types. The enum is 4 bytes in size.

```c
copy
//0x4 bytes (sizeof)
enum _ETW_GUID_TYPE
{
    EtwTraceGuidType = 0,
    EtwNotificationGuidType = 1,
    EtwGroupGuidType = 2,
    EtwGuidTypeMax = 3
}; 

```

--------------------------------

### _ETW_GUID_ENTRY structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-vista/rtm/_ETW_GUID_ENTRY

Defines the _ETW_GUID_ENTRY structure, which is 0x170 bytes in size. It contains a list entry, reference count, GUID, registration list head, security descriptor, legacy enable context, legacy provider enabled flag, provider enable info, and an array of enable info structures. This structure is used in _ETW_REG_ENTRY.

```cpp
//0x170 bytes (sizeof)
struct _ETW_GUID_ENTRY
{
    struct _LIST_ENTRY GuidList;                                            //0x0
    volatile LONG RefCount;                                                 //0x10
    struct _GUID Guid;                                                      //0x14
    struct _LIST_ENTRY RegListHead;                                         //0x28
    VOID* SecurityDescriptor;                                               //0x38
    struct _TRACE_ENABLE_CONTEXT LegacyEnableContext;                       //0x40
    ULONG LegacyProviderEnabled;                                            //0x48
    struct _TRACE_ENABLE_INFO ProviderEnableInfo;                           //0x50
    struct _TRACE_ENABLE_INFO EnableInfo[8];                                //0x70
};
```

--------------------------------

### _ETW_GUID_TYPE enumeration definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-7/sp1/_ETW_GUID_TYPE

Defines the _ETW_GUID_TYPE enum with values for trace and notification GUID types. The enum is 4 bytes in size. Use this to identify the type of ETW GUID in kernel-mode drivers or tracing code.

```cpp
//0x4 bytes (sizeof)
enum _ETW_GUID_TYPE
{
    EtwTraceGuidType = 0,
    EtwNotificationGuidType = 1,
    EtwGuidTypeMax = 2
}; 
```

--------------------------------

### _IO_DRIVER_CREATE_CONTEXT structure definition

Source: https://www.vergiliusproject.com/kernels/x64/server-2022/21h2/_IO_DRIVER_CREATE_CONTEXT

Defines the _IO_DRIVER_CREATE_CONTEXT structure, 0x28 bytes in size, with fields for size, extra create parameter, device object hint, transaction parameters, and silo context. Used in _OPEN_PACKET.

```c
copy
//0x28 bytes (sizeof)
struct _IO_DRIVER_CREATE_CONTEXT
{
    SHORT Size;                                                             //0x0
    struct _ECP_LIST* ExtraCreateParameter;                                 //0x8
    VOID* DeviceObjectHint;                                                 //0x10
    struct _TXN_PARAMETER_BLOCK* TxnParameters;                             //0x18
    struct _EJOB* SiloContext;                                              //0x20
}; 

```

--------------------------------

### Define _ETW_GUID_TYPE enum (ETW GUID types)

Source: https://www.vergiliusproject.com/kernels/x64/windows-10/1903/_ETW_GUID_TYPE

C enum defining ETW GUID types. EtwTraceGuidType is 0, EtwNotificationGuidType is 1, EtwGroupGuidType is 2, and EtwGuidTypeMax is 3. The size of the enum is 0x4 bytes.

```c
//0x4 bytes (sizeof)
enum _ETW_GUID_TYPE
{
    EtwTraceGuidType = 0,
    EtwNotificationGuidType = 1,
    EtwGroupGuidType = 2,
    EtwGuidTypeMax = 3
};
```

--------------------------------

### _HANDLE_TRACE_DB_ENTRY structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-8/rtm/_HANDLE_TRACE_DB_ENTRY

Defines the _HANDLE_TRACE_DB_ENTRY structure with a client ID, handle, type, and stack trace array. The structure is 0xa0 bytes in size and is used in _HANDLE_TRACE_DEBUG_INFO.

```c
copy
//0xa0 bytes (sizeof)
struct _HANDLE_TRACE_DB_ENTRY
{
    struct _CLIENT_ID ClientId;                                             //0x0
    VOID* Handle;                                                           //0x10
    ULONG Type;                                                             //0x18
    VOID* StackTrace[16];                                                   //0x20
}; 

```

--------------------------------

### ETW GUID Type Enumeration

Source: https://www.vergiliusproject.com/kernels/x64/windows-7/rtm/_ETW_GUID_TYPE

Defines the _ETW_GUID_TYPE enum with three members: EtwTraceGuidType (0), EtwNotificationGuidType (1), and EtwGuidTypeMax (2). The enum is 4 bytes in size and is used to specify the type of GUID in ETW operations.

```cpp
copy
//0x4 bytes (sizeof)
enum _ETW_GUID_TYPE
{
    EtwTraceGuidType = 0,
    EtwNotificationGuidType = 1,
    EtwGuidTypeMax = 2
}; 
```

--------------------------------

### _WMI_BUFFER_HEADER structure definition

Source: https://www.vergiliusproject.com/kernels/x64/server-2022/21h2/_WMI_BUFFER_HEADER

Defines the _WMI_BUFFER_HEADER structure with fields for buffer size, offsets, reference count, timestamp, sequence number, and a union for clock type, frequency, singly linked list entry, or next buffer pointer. Also includes client context, state, offset, flags, and a union for padding, reference time, global entry, or pointers.

```c
copy
//0x48 bytes (sizeof)
struct _WMI_BUFFER_HEADER
{
    ULONG BufferSize;                                                       //0x0
    ULONG SavedOffset;                                                      //0x4
    volatile ULONG CurrentOffset;                                           //0x8
    volatile LONG ReferenceCount;                                           //0xc
    union _LARGE_INTEGER TimeStamp;                                         //0x10
    LONGLONG SequenceNumber;                                                //0x18
    union
    {
        struct
        {
            ULONGLONG ClockType:3;                                          //0x20
            ULONGLONG Frequency:61;                                         //0x20
        };
        struct _SINGLE_LIST_ENTRY SlistEntry;                               //0x20
        struct _WMI_BUFFER_HEADER* NextBuffer;                              //0x20
    };
    struct _ETW_BUFFER_CONTEXT ClientContext;                               //0x28
    enum _ETW_BUFFER_STATE State;                                           //0x2c
    ULONG Offset;                                                           //0x30
    USHORT BufferFlag;                                                      //0x34
    USHORT BufferType;                                                      //0x36
    union
    {
        ULONG Padding1[4];                                                  //0x38
        struct _ETW_REF_CLOCK ReferenceTime;                                //0x38
        struct _LIST_ENTRY GlobalEntry;                                     //0x38
        struct
        {
            VOID* Pointer0;                                                 //0x38
            VOID* Pointer1;                                                 //0x40
        };
    };
}; 

```

--------------------------------

### _ETW_GUID_ENTRY structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-10/1803/_ETW_GUID_ENTRY

Defines the _ETW_GUID_ENTRY structure with fields for GUID list, reference count, GUID, registration list, security descriptor, enable info, filter data, silo state, lock, and lock owner. The structure size is 0x190 bytes.

```c
copy
//0x190 bytes (sizeof)
struct _ETW_GUID_ENTRY
{
    struct _LIST_ENTRY GuidList;                                            //0x0
    volatile LONGLONG RefCount;                                             //0x10
    struct _GUID Guid;                                                      //0x18
    struct _LIST_ENTRY RegListHead;                                         //0x28
    VOID* SecurityDescriptor;                                               //0x38
    union
    {
        struct _ETW_LAST_ENABLE_INFO LastEnable;                            //0x40
        ULONGLONG MatchId;                                                  //0x40
    };
    struct _TRACE_ENABLE_INFO ProviderEnableInfo;                           //0x50
    struct _TRACE_ENABLE_INFO EnableInfo[8];                                //0x70
    struct _ETW_FILTER_HEADER* FilterData;                                  //0x170
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x178
    struct _EX_PUSH_LOCK Lock;                                              //0x180
    struct _ETHREAD* LockOwner;                                             //0x188
}; 
```

--------------------------------

### _OBJECT_CREATE_INFORMATION structure definition

Source: https://www.vergiliusproject.com/kernels/x64/server-2022/21h2/_OBJECT_CREATE_INFORMATION

Defines the _OBJECT_CREATE_INFORMATION structure with fields for object creation parameters. The structure is 0x40 bytes in size. It is used in _OBJECT_HEADER.

```c
//0x40 bytes (sizeof)
struct _OBJECT_CREATE_INFORMATION
{
    ULONG Attributes;                                                       //0x0
    VOID* RootDirectory;                                                    //0x8
    CHAR ProbeMode;                                                         //0x10
    ULONG PagedPoolCharge;                                                  //0x14
    ULONG NonPagedPoolCharge;                                               //0x18
    ULONG SecurityDescriptorCharge;                                         //0x1c
    VOID* SecurityDescriptor;                                               //0x20
    struct _SECURITY_QUALITY_OF_SERVICE* SecurityQos;                       //0x28
    struct _SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;           //0x30
}; 
```

--------------------------------

### Define _EXT_IOMMU_S1_X64_DOMAIN_SETTINGS structure

Source: https://www.vergiliusproject.com/kernels/x64/windows-11/25h2/_EXT_IOMMU_S1_X64_DOMAIN_SETTINGS

Definition of the _EXT_IOMMU_S1_X64_DOMAIN_SETTINGS structure, 0x10 bytes in size. The Flags bitfield includes EnableTranslation, Blocked, EnableDefaultPasid, FirstStagePagingMode, and Reserved bits. PageTableRoot is an 8-byte field at offset 0x8. Used by _EXT_IOMMU_DOMAIN_SETTINGS.

```c
//0x10 bytes (sizeof)
struct _EXT_IOMMU_S1_X64_DOMAIN_SETTINGS
{
    struct
    {
        UCHAR EnableTranslation:1;                                          //0x0
        UCHAR Blocked:1;                                                    //0x0
        UCHAR EnableDefaultPasid:1;                                         //0x0
        UCHAR FirstStagePagingMode:1;                                       //0x0
        UCHAR Reserved:4;                                                   //0x0
    } Flags;                                                                //0x0
    ULONGLONG PageTableRoot;                                                //0x8
};
```

--------------------------------

### _ETW_GUID_ENTRY structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-10/22h2/_ETW_GUID_ENTRY

Defines the _ETW_GUID_ENTRY structure with fields for GUID lists, reference count, GUID, registration list, security descriptor, enable info, filter data, silo state, host entry, lock, and lock owner. The structure is 0x1a8 bytes in size.

```c
copy
//0x1a8 bytes (sizeof)
struct _ETW_GUID_ENTRY
{
    struct _LIST_ENTRY GuidList;                                            //0x0
    struct _LIST_ENTRY SiloGuidList;                                        //0x10
    volatile LONGLONG RefCount;                                             //0x20
    struct _GUID Guid;                                                      //0x28
    struct _LIST_ENTRY RegListHead;                                         //0x38
    VOID* SecurityDescriptor;                                               //0x48
    union
    {
        struct _ETW_LAST_ENABLE_INFO LastEnable;                            //0x50
        ULONGLONG MatchId;                                                  //0x50
    };
    struct _TRACE_ENABLE_INFO ProviderEnableInfo;                           //0x60
    struct _TRACE_ENABLE_INFO EnableInfo[8];                                //0x80
    struct _ETW_FILTER_HEADER* FilterData;                                  //0x180
    struct _ETW_SILODRIVERSTATE* SiloState;                                 //0x188
    struct _ETW_GUID_ENTRY* HostEntry;                                      //0x190
    struct _EX_PUSH_LOCK Lock;                                              //0x198
    struct _ETHREAD* LockOwner;                                             //0x1a0
}; 
```

--------------------------------

### _EXT_IOMMU_FLUSH_CONTEXT structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-11/23h2/_EXT_IOMMU_FLUSH_CONTEXT

Defines the _EXT_IOMMU_FLUSH_CONTEXT structure with a union containing Intel and AMD variants. The Intel variant has Status and PhysicalAddress fields, while the AMD variant has StatusAddr and OldStatus fields. The structure is 0x10 bytes in size.

```c
//0x10 bytes (sizeof)
struct _EXT_IOMMU_FLUSH_CONTEXT
{
    union
    {
        struct
        {
            ULONG Status;                                                   //0x0
            ULONGLONG PhysicalAddress;                                      //0x8
        } Intel;                                                            //0x0
        struct
        {
            ULONGLONG* StatusAddr;                                          //0x0
            ULONGLONG OldStatus;                                            //0x8
        } Amd;                                                              //0x0
    };
}; 

```

--------------------------------

### ETW Notification Type Enumeration

Source: https://www.vergiliusproject.com/kernels/x64/windows-11/23h2/_ETW_NOTIFICATION_TYPE

Defines the _ETW_NOTIFICATION_TYPE enum with 12 members, starting at 1. Used in _ETWP_NOTIFICATION_HEADER.

```c
//0x4 bytes (sizeof)
enum _ETW_NOTIFICATION_TYPE
{
    EtwNotificationTypeNoReply = 1,
    EtwNotificationTypeLegacyEnable = 2,
    EtwNotificationTypeEnable = 3,
    EtwNotificationTypePrivateLogger = 4,
    EtwNotificationTypePerflib = 5,
    EtwNotificationTypeAudio = 6,
    EtwNotificationTypeSession = 7,
    EtwNotificationTypeReserved = 8,
    EtwNotificationTypeCredentialUI = 9,
    EtwNotificationTypeInProcSession = 10,
    EtwNotificationTypeFilteredPrivateLogger = 11,
    EtwNotificationTypeMax = 12
};
```

--------------------------------

### _OBJECT_CREATE_INFORMATION structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-vista/rtm/_OBJECT_CREATE_INFORMATION

Defines the _OBJECT_CREATE_INFORMATION structure with fields for object attributes, root directory, parse context, probe mode, pool charges, security descriptor, and security quality of service. The structure is 0x48 bytes in size.

```c
copy
//0x48 bytes (sizeof)
struct _OBJECT_CREATE_INFORMATION
{
    ULONG Attributes;                                                       //0x0
    VOID* RootDirectory;                                                    //0x8
    VOID* ParseContext;                                                     //0x10
    CHAR ProbeMode;                                                         //0x18
    ULONG PagedPoolCharge;                                                  //0x1c
    ULONG NonPagedPoolCharge;                                               //0x20
    ULONG SecurityDescriptorCharge;                                         //0x24
    VOID* SecurityDescriptor;                                               //0x28
    struct _SECURITY_QUALITY_OF_SERVICE* SecurityQos;                       //0x30
    struct _SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;           //0x38
};
```

--------------------------------

### _TlgProviderMetadata_t structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-10/21h1/_TlgProviderMetadata_t

Defines the _TlgProviderMetadata_t structure with a Type field, a ProviderId GUID, and a RemainingSize field. The structure is 0x13 bytes in size.

```c
//0x13 bytes (sizeof)
struct _tlgProviderMetadata_t
{
    UCHAR Type;                                                             //0x0
    struct _GUID ProviderId;                                                //0x1
    USHORT RemainingSize;                                                   //0x11
}; 

```

--------------------------------

### _IO_CLIENT_EXTENSION structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-vista/rtm/_IO_CLIENT_EXTENSION

Definition of the _IO_CLIENT_EXTENSION structure, 0x10 bytes in size, with NextExtension at offset 0x0 and ClientIdentificationAddress at offset 0x8. Used by _DRIVER_EXTENSION.

```c
//0x10 bytes (sizeof)
struct _IO_CLIENT_EXTENSION
{
    struct _IO_CLIENT_EXTENSION* NextExtension;                             //0x0
    VOID* ClientIdentificationAddress;                                      //0x8
}; 

```

--------------------------------

### _HEAP_FREE_ENTRY structure definition (C)

Source: https://www.vergiliusproject.com/kernels/x64/windows-vista/rtm/_HEAP_FREE_ENTRY

Defines the 0x20-byte _HEAP_FREE_ENTRY structure used by the Windows heap manager. Includes unions for the standard header fields (PreviousBlockPrivateData, Size, Flags, SmallTagIndex, PreviousSize, SegmentOffset/LFHFlags, UnusedBytes) and an alternative interceptor layout with Reserved, FunctionIndex/ContextValue, InterceptorValue, UnusedBytesLength, EntryOffset, and ExtendedBlockSignature.

```c
//0x20 bytes (sizeof)
struct _HEAP_FREE_ENTRY
{
    union
    {
        struct
        {
            VOID* PreviousBlockPrivateData;                                 //0x0
            union
            {
                struct
                {
                    USHORT Size;                                            //0x8
                    UCHAR Flags;                                            //0xa
                    UCHAR SmallTagIndex;                                    //0xb
                    USHORT PreviousSize;                                    //0xc
                    union
                    {
                        UCHAR SegmentOffset;                                //0xe
                        UCHAR LFHFlags;                                     //0xe
                    };
                    UCHAR UnusedBytes;                                      //0xf
                };
                ULONGLONG CompactHeader;                                    //0x8
            };
        };
        struct
        {
            VOID* Reserved;                                                 //0x0
            union
            {
                struct
                {   USHORT FunctionIndex;                                   //0x8
                    USHORT ContextValue;                                    //0xa
                };
                ULONG InterceptorValue;                                     //0x8
            };
            USHORT UnusedBytesLength;                                       //0xc
            UCHAR EntryOffset;                                              //0xe
            UCHAR ExtendedBlockSignature;                                   //0xf
        };
    };
}   //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes (sizeof)  //0x20 bytes
```

--------------------------------

### _HEAP_FAILURE_TYPE enumeration definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-8/rtm/_HEAP_FAILURE_TYPE

Defines the _HEAP_FAILURE_TYPE enum with 15 failure types, starting at 0. The comment indicates the size is 4 bytes.

```c
//0x4 bytes (sizeof)
enum _HEAP_FAILURE_TYPE
{
    heap_failure_internal = 0,
    heap_failure_unknown = 1,
    heap_failure_generic = 2,
    heap_failure_entry_corruption = 3,
    heap_failure_multiple_entries_corruption = 4,
    heap_failure_virtual_block_corruption = 5,
    heap_failure_buffer_overrun = 6,
    heap_failure_buffer_underrun = 7,
    heap_failure_block_not_busy = 8,
    heap_failure_invalid_argument = 9,
    heap_failure_usage_after_free = 10,
    heap_failure_cross_heap_operation = 11,
    heap_failure_freelists_corruption = 12,
    heap_failure_listentry_corruption = 13,
    heap_failure_lfh_bitmap_mismatch = 14
}; 
```

--------------------------------

### _MI_VERIFIER_DRIVER_ENTRY structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-vista/rtm/_MI_VERIFIER_DRIVER_ENTRY

C structure definition for _MI_VERIFIER_DRIVER_ENTRY, 0xa0 bytes in size. Includes fields for tracking driver loads/unloads, base name, start/end addresses, flags, signature, pool page headers, pool trackers, and pool allocation statistics.

```c
copy
//0xa0 bytes (sizeof)
struct _MI_VERIFIER_DRIVER_ENTRY
{
    struct _LIST_ENTRY Links;                                               //0x0
    ULONG Loads;                                                            //0x10
    ULONG Unloads;                                                          //0x14
    struct _UNICODE_STRING BaseName;                                        //0x18
    VOID* StartAddress;                                                     //0x28
    VOID* EndAddress;                                                       //0x30
    ULONG Flags;                                                            //0x38
    ULONGLONG Signature;                                                    //0x40
    union _SLIST_HEADER PoolPageHeaders;                                    //0x50
    union _SLIST_HEADER PoolTrackers;                                       //0x60
    ULONG CurrentPagedPoolAllocations;                                      //0x70
    ULONG CurrentNonPagedPoolAllocations;                                   //0x74
    ULONG PeakPagedPoolAllocations;                                         //0x78
    ULONG PeakNonPagedPoolAllocations;                                      //0x7c
    ULONGLONG PagedBytes;                                                   //0x80
    ULONGLONG NonPagedBytes;                                                //0x88
    struct _MI_VERIFIER_DRIVER_ENTRY* Next;                                 //0x90
    struct _MI_VERIFIER_DRIVER_ENTRY* Prev;                                 //0x98
};//sizeof:0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=
```

--------------------------------

### _VF_ADDRESS_RANGE structure definition

Source: https://www.vergiliusproject.com/kernels/x64/windows-7/sp1/_VF_ADDRESS_RANGE

Defines the _VF_ADDRESS_RANGE structure with Start and End pointer fields. The structure is 0x10 bytes in size. Used by _VI_DEADLOCK_GLOBALS.

```c
copy
//0x10 bytes (sizeof)
struct _VF_ADDRESS_RANGE
{
    UCHAR* Start;                                                           //0x0
    UCHAR* End;                                                             //0x8
}; 
```
Tokens:
Raw