### _VF_DRIVER_IO_CALLBACKS structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-10/1507/_VF_DRIVER_IO_CALLBACKS Defines the _VF_DRIVER_IO_CALLBACKS structure with function pointers for driver initialization, start I/O, unload, add device, and major function callbacks. The structure is 0x100 bytes in size. ```c //0x100 bytes (sizeof) struct _VF_DRIVER_IO_CALLBACKS { LONG (*DriverInit)(struct _DRIVER_OBJECT* arg1, struct _UNICODE_STRING* arg2); //0x0 VOID (*DriverStartIo)(struct _DEVICE_OBJECT* arg1, struct _IRP* arg2); //0x8 VOID (*DriverUnload)(struct _DRIVER_OBJECT* arg1); //0x10 LONG (*AddDevice)(struct _DRIVER_OBJECT* arg1, struct _DEVICE_OBJECT* arg2); //0x18 LONG (*MajorFunction[28])(struct _DEVICE_OBJECT* arg1, struct _IRP* arg2); //0x20 }; ``` -------------------------------- ### _ETW_GUID_ENTRY structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-10/1511/_ETW_GUID_ENTRY Defines the _ETW_GUID_ENTRY structure with fields for GUID list, reference count, GUID, registration list, security descriptor, last enable info, provider enable info, enable info array, filter data, host silo, lock, and lock owner. The structure size is 0x190 bytes. ```c //0x190 bytes (sizeof) struct _ETW_GUID_ENTRY { struct _LIST_ENTRY GuidList; //0x0 volatile LONGLONG RefCount; //0x10 struct _GUID Guid; //0x18 struct _LIST_ENTRY RegListHead; //0x28 VOID* SecurityDescriptor; //0x38 union { struct _ETW_LAST_ENABLE_INFO LastEnable; //0x40 ULONGLONG MatchId; //0x40 }; struct _TRACE_ENABLE_INFO ProviderEnableInfo; //0x50 struct _TRACE_ENABLE_INFO EnableInfo[8]; //0x70 struct _ETW_FILTER_HEADER* FilterData; //0x170 UCHAR HostSilo; //0x178 struct _EX_PUSH_LOCK Lock; //0x180 struct _ETHREAD* LockOwner; //0x188 }; ``` -------------------------------- ### _ETW_GUID_ENTRY structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-11/23h2/_ETW_GUID_ENTRY C structure definition for _ETW_GUID_ENTRY, 0x1a8 bytes in size. Includes GUID list entries, reference count, GUID, security descriptor, enable info arrays, and filter data. ```c copy //0x1a8 bytes (sizeof) struct _ETW_GUID_ENTRY { struct _LIST_ENTRY GuidList; //0x0 struct _LIST_ENTRY SiloGuidList; //0x10 volatile LONGLONG RefCount; //0x20 struct _GUID Guid; //0x28 struct _LIST_ENTRY RegListHead; //0x38 VOID* SecurityDescriptor; //0x48 union { struct _ETW_LAST_ENABLE_INFO LastEnable; //0x50 ULONGLONG MatchId; //0x50 }; struct _TRACE_ENABLE_INFO ProviderEnableInfo; //0x60 struct _TRACE_ENABLE_INFO EnableInfo[8]; //0x80 struct _ETW_FILTER_HEADER* FilterData; //0x180 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 } ``` ```c copy //0x1a8 bytes (sizeof) struct _ETW_GUID_ENTRY { struct _LIST_ENTRY GuidList; //0x0 struct _LIST_ENTRY SiloGuidList; //0x10 volatile LONGLONG RefCount; //0x20 struct _GUID Guid; //0x28 struct _LIST_ENTRY RegListHead; //0x38 VOID* SecurityDescriptor; //0x48 union { struct _ETW_LAST_ENABLE_INFO LastEnable; //0x50 ULONGLONG MatchId; //0x50 }; struct _TRACE_ENABLE_INFO ProviderEnableInfo; //0x60 struct _TRACE_ENABLE_INFO EnableInfo[8]; //0x80 struct _ETW_FILTER_HEADER* FilterData; //0x180 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_SILODRIVERSTATE* Silo ``` -------------------------------- ### _ETW_GUID_ENTRY structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-11/25h2/_ETW_GUID_ENTRY Definition of the _ETW_GUID_ENTRY structure, 0x1a8 bytes in size, used by ETW to track GUID-based providers. Contains linked lists, a GUID, enable information arrays, and a lock. Referenced by _ETW_REG_ENTRY and _ETW_SILODRIVERSTATE. ```c //0x1a8 bytes (sizeof) struct _ETW_GUID_ENTRY { struct _LIST_ENTRY GuidList; //0x0 struct _LIST_ENTRY SiloGuidList; //0x10 volatile LONGLONG RefCount; //0x20 struct _GUID Guid; //0x28 struct _LIST_ENTRY RegListHead; //0x38 VOID* SecurityDescriptor; //0x48 union { struct _ETW_LAST_ENABLE_INFO LastEnable; //0x50 ULONGLONG MatchId; //0x50 }; struct _TRACE_ENABLE_INFO ProviderEnableInfo; //0x60 struct _TRACE_ENABLE_INFO EnableInfo[8]; //0x80 struct _ETW_FILTER_HEADER* FilterData; //0x180 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_GUID_ENTRY* HostEntry; //0x190 struct _EX_PUSH_LOCK Lock; //0x198 struct _ETHREAD* LockOwner; //0x1a0 }; ``` -------------------------------- ### _ETW_GUID_ENTRY structure definition (C) Source: https://www.vergiliusproject.com/kernels/x64/windows-10/1709/_ETW_GUID_ENTRY Defines the _ETW_GUID_ENTRY structure used in Windows 10 1703, 1709, and 1803. The structure is 0x190 bytes and includes fields for GUID management, reference counting, security, provider enable info, and filter data. ```c //0x190 bytes (sizeof) struct _ETW_GUID_ENTRY { struct _LIST_ENTRY GuidList; //0x0 volatile LONGLONG RefCount; //0x10 struct _GUID Guid; //0x18 struct _LIST_ENTRY RegListHead; //0x28 VOID* SecurityDescriptor; //0x38 union { struct _ETW_LAST_ENABLE_INFO LastEnable; //0x40 ULONGLONG MatchId; //0x40 }; struct _TRACE_ENABLE_INFO ProviderEnableInfo; //0x50 struct _TRACE_ENABLE_INFO EnableInfo[8]; //0x70 struct _ETW_FILTER_HEADER* FilterData; //0x170 struct _ETW_SILODRIVERSTATE* SiloState; //0x178 struct _EX_PUSH_LOCK Lock; //0x180 struct _ETHREAD* LockOwner; //0x188 }; ``` -------------------------------- ### Define _TRACE_LOGFILE_HEADER structure Source: https://www.vergiliusproject.com/kernels/x64/windows-11/22h2/_TRACE_LOGFILE_HEADER Defines the _TRACE_LOGFILE_HEADER structure used in Windows 11 21H2, 22H2, and 23H2. The structure is 0x118 bytes in size and contains fields for buffer size, version, provider version, processor count, timing information, and logging statistics. The union members allow access to version details and log instance GUID or start buffers, pointer size, events lost, and CPU speed. ```c copy //0x118 bytes (sizeof) struct _TRACE_LOGFILE_HEADER { ULONG BufferSize; //0x0 union { ULONG Version; //0x4 struct { UCHAR MajorVersion; //0x4 UCHAR MinorVersion; //0x5 UCHAR SubVersion; //0x6 UCHAR SubMinorVersion; //0x7 } VersionDetail; //0x4 }; ULONG ProviderVersion; //0x8 ULONG NumberOfProcessors; //0xc union _LARGE_INTEGER EndTime; //0x10 ULONG TimerResolution; //0x18 ULONG MaximumFileSize; //0x1c ULONG LogFileMode; //0x20 ULONG BuffersWritten; //0x24 union { struct _GUID LogInstanceGuid; //0x28 struct { ULONG StartBuffers; //0x28 ULONG PointerSize; //0x2c ULONG EventsLost; //0x30 ULONG CpuSpeedInMHz; //0x34 }; }; WCHAR* LoggerName; //0x38 WCHAR* LogFileName; //0x40 struct _RTL_TIME_ZONE_INFORMATION TimeZone; //0x48 union _LARGE_INTEGER BootTime; //0xf8 union _LARGE_INTEGER PerfFreq; //0x100 union _LARGE_INTEGER StartTime; //0x108 ULONG ReservedFlags; //0x110 ULONG BuffersLost; //0x114 }; ``` -------------------------------- ### Windows XP SP2 _PLUGPLAY_EVENT_BLOCK structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-xp/sp2/_PLUGPLAY_EVENT_BLOCK Structure definition for Windows XP/Server 2003 SP2 plug-and-play event block, used in _PNP_DEVICE_EVENT_ENTRY. Contains event GUID, category, result pointer, flags, size, device object, and a union of event-specific data structures for device class, target device, installation, custom and profile notifications, power, veto, blocked driver, and invalid ID events. ```c struct _PLUGPLAY_EVENT_BLOCK { struct _GUID EventGuid; //0x0 enum _PLUGPLAY_EVENT_CATEGORY EventCategory; //0x10 ULONG* Result; //0x18 ULONG Flags; //0x20 ULONG TotalSize; //0x24 VOID* DeviceObject; //0x28 union { struct { struct _GUID ClassGuid; //0x30 USHORT SymbolicLinkName[1]; //0x40 } DeviceClass; //0x30 struct { USHORT DeviceIds[1]; //0x30 } TargetDevice; //0x30 struct { USHORT DeviceId[1]; //0x30 } InstallDevice; //0x30 struct { VOID* NotificationStructure; //0x30 USHORT DeviceIds[1]; //0x38 } CustomNotification; //0x30 struct { VOID* Notification; //0x30 } ProfileNotification; //0x30 struct { ULONG NotificationCode; //0x30 ULONG NotificationData; //0x34 } PowerNotification; //0x30 struct { enum _PNP_VETO_TYPE VetoType; //0x30 USHORT DeviceIdVetoNameBuffer[1]; //0x34 } VetoNotification; //0x30 struct { struct _GUID BlockedDriverGuid; //0x30 } BlockedDriverNotification; //0x30 struct { USHORT ParentId[1]; //0x30 } InvalidIDNotification; //0x30 } u; //0x30 }; ``` -------------------------------- ### _IO_COMPLETION_CONTEXT structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-10/1803/_IO_COMPLETION_CONTEXT Defines the _IO_COMPLETION_CONTEXT structure with two VOID pointers, Port at offset 0x0 and Key at offset 0x8. The structure is 0x10 bytes in size. ```c copy //0x10 bytes (sizeof) struct _IO_COMPLETION_CONTEXT { VOID* Port; //0x0 VOID* Key; //0x8 }; ``` -------------------------------- ### _IO_COMPLETION_CONTEXT structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-11/23h2/_IO_COMPLETION_CONTEXT Definition of the _IO_COMPLETION_CONTEXT structure, 0x18 bytes in size, with Port at offset 0x0, Key at 0x8, and UsageCount at 0x10. Used by _FILE_OBJECT. ```c copy //0x18 bytes (sizeof) struct _IO_COMPLETION_CONTEXT { VOID* Port; //0x0 VOID* Key; //0x8 LONGLONG UsageCount; //0x10 }; ``` -------------------------------- ### ETW GUID Type Enumeration Source: https://www.vergiliusproject.com/kernels/x64/server-2022/21h2/_ETW_GUID_TYPE Defines the _ETW_GUID_TYPE enum with values for trace, notification, group, and max GUID types. The enum is 4 bytes in size. ```c copy //0x4 bytes (sizeof) enum _ETW_GUID_TYPE { EtwTraceGuidType = 0, EtwNotificationGuidType = 1, EtwGroupGuidType = 2, EtwGuidTypeMax = 3 }; ``` -------------------------------- ### _ETW_GUID_ENTRY structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-vista/rtm/_ETW_GUID_ENTRY Defines the _ETW_GUID_ENTRY structure, which is 0x170 bytes in size. It contains a list entry, reference count, GUID, registration list head, security descriptor, legacy enable context, legacy provider enabled flag, provider enable info, and an array of enable info structures. This structure is used in _ETW_REG_ENTRY. ```cpp //0x170 bytes (sizeof) struct _ETW_GUID_ENTRY { struct _LIST_ENTRY GuidList; //0x0 volatile LONG RefCount; //0x10 struct _GUID Guid; //0x14 struct _LIST_ENTRY RegListHead; //0x28 VOID* SecurityDescriptor; //0x38 struct _TRACE_ENABLE_CONTEXT LegacyEnableContext; //0x40 ULONG LegacyProviderEnabled; //0x48 struct _TRACE_ENABLE_INFO ProviderEnableInfo; //0x50 struct _TRACE_ENABLE_INFO EnableInfo[8]; //0x70 }; ``` -------------------------------- ### _ETW_GUID_TYPE enumeration definition Source: https://www.vergiliusproject.com/kernels/x64/windows-7/sp1/_ETW_GUID_TYPE Defines the _ETW_GUID_TYPE enum with values for trace and notification GUID types. The enum is 4 bytes in size. Use this to identify the type of ETW GUID in kernel-mode drivers or tracing code. ```cpp //0x4 bytes (sizeof) enum _ETW_GUID_TYPE { EtwTraceGuidType = 0, EtwNotificationGuidType = 1, EtwGuidTypeMax = 2 }; ``` -------------------------------- ### _IO_DRIVER_CREATE_CONTEXT structure definition Source: https://www.vergiliusproject.com/kernels/x64/server-2022/21h2/_IO_DRIVER_CREATE_CONTEXT Defines the _IO_DRIVER_CREATE_CONTEXT structure, 0x28 bytes in size, with fields for size, extra create parameter, device object hint, transaction parameters, and silo context. Used in _OPEN_PACKET. ```c copy //0x28 bytes (sizeof) struct _IO_DRIVER_CREATE_CONTEXT { SHORT Size; //0x0 struct _ECP_LIST* ExtraCreateParameter; //0x8 VOID* DeviceObjectHint; //0x10 struct _TXN_PARAMETER_BLOCK* TxnParameters; //0x18 struct _EJOB* SiloContext; //0x20 }; ``` -------------------------------- ### Define _ETW_GUID_TYPE enum (ETW GUID types) Source: https://www.vergiliusproject.com/kernels/x64/windows-10/1903/_ETW_GUID_TYPE C enum defining ETW GUID types. EtwTraceGuidType is 0, EtwNotificationGuidType is 1, EtwGroupGuidType is 2, and EtwGuidTypeMax is 3. The size of the enum is 0x4 bytes. ```c //0x4 bytes (sizeof) enum _ETW_GUID_TYPE { EtwTraceGuidType = 0, EtwNotificationGuidType = 1, EtwGroupGuidType = 2, EtwGuidTypeMax = 3 }; ``` -------------------------------- ### _HANDLE_TRACE_DB_ENTRY structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-8/rtm/_HANDLE_TRACE_DB_ENTRY Defines the _HANDLE_TRACE_DB_ENTRY structure with a client ID, handle, type, and stack trace array. The structure is 0xa0 bytes in size and is used in _HANDLE_TRACE_DEBUG_INFO. ```c copy //0xa0 bytes (sizeof) struct _HANDLE_TRACE_DB_ENTRY { struct _CLIENT_ID ClientId; //0x0 VOID* Handle; //0x10 ULONG Type; //0x18 VOID* StackTrace[16]; //0x20 }; ``` -------------------------------- ### ETW GUID Type Enumeration Source: https://www.vergiliusproject.com/kernels/x64/windows-7/rtm/_ETW_GUID_TYPE Defines the _ETW_GUID_TYPE enum with three members: EtwTraceGuidType (0), EtwNotificationGuidType (1), and EtwGuidTypeMax (2). The enum is 4 bytes in size and is used to specify the type of GUID in ETW operations. ```cpp copy //0x4 bytes (sizeof) enum _ETW_GUID_TYPE { EtwTraceGuidType = 0, EtwNotificationGuidType = 1, EtwGuidTypeMax = 2 }; ``` -------------------------------- ### _WMI_BUFFER_HEADER structure definition Source: https://www.vergiliusproject.com/kernels/x64/server-2022/21h2/_WMI_BUFFER_HEADER Defines the _WMI_BUFFER_HEADER structure with fields for buffer size, offsets, reference count, timestamp, sequence number, and a union for clock type, frequency, singly linked list entry, or next buffer pointer. Also includes client context, state, offset, flags, and a union for padding, reference time, global entry, or pointers. ```c copy //0x48 bytes (sizeof) struct _WMI_BUFFER_HEADER { ULONG BufferSize; //0x0 ULONG SavedOffset; //0x4 volatile ULONG CurrentOffset; //0x8 volatile LONG ReferenceCount; //0xc union _LARGE_INTEGER TimeStamp; //0x10 LONGLONG SequenceNumber; //0x18 union { struct { ULONGLONG ClockType:3; //0x20 ULONGLONG Frequency:61; //0x20 }; struct _SINGLE_LIST_ENTRY SlistEntry; //0x20 struct _WMI_BUFFER_HEADER* NextBuffer; //0x20 }; struct _ETW_BUFFER_CONTEXT ClientContext; //0x28 enum _ETW_BUFFER_STATE State; //0x2c ULONG Offset; //0x30 USHORT BufferFlag; //0x34 USHORT BufferType; //0x36 union { ULONG Padding1[4]; //0x38 struct _ETW_REF_CLOCK ReferenceTime; //0x38 struct _LIST_ENTRY GlobalEntry; //0x38 struct { VOID* Pointer0; //0x38 VOID* Pointer1; //0x40 }; }; }; ``` -------------------------------- ### _ETW_GUID_ENTRY structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-10/1803/_ETW_GUID_ENTRY Defines the _ETW_GUID_ENTRY structure with fields for GUID list, reference count, GUID, registration list, security descriptor, enable info, filter data, silo state, lock, and lock owner. The structure size is 0x190 bytes. ```c copy //0x190 bytes (sizeof) struct _ETW_GUID_ENTRY { struct _LIST_ENTRY GuidList; //0x0 volatile LONGLONG RefCount; //0x10 struct _GUID Guid; //0x18 struct _LIST_ENTRY RegListHead; //0x28 VOID* SecurityDescriptor; //0x38 union { struct _ETW_LAST_ENABLE_INFO LastEnable; //0x40 ULONGLONG MatchId; //0x40 }; struct _TRACE_ENABLE_INFO ProviderEnableInfo; //0x50 struct _TRACE_ENABLE_INFO EnableInfo[8]; //0x70 struct _ETW_FILTER_HEADER* FilterData; //0x170 struct _ETW_SILODRIVERSTATE* SiloState; //0x178 struct _EX_PUSH_LOCK Lock; //0x180 struct _ETHREAD* LockOwner; //0x188 }; ``` -------------------------------- ### _OBJECT_CREATE_INFORMATION structure definition Source: https://www.vergiliusproject.com/kernels/x64/server-2022/21h2/_OBJECT_CREATE_INFORMATION Defines the _OBJECT_CREATE_INFORMATION structure with fields for object creation parameters. The structure is 0x40 bytes in size. It is used in _OBJECT_HEADER. ```c //0x40 bytes (sizeof) struct _OBJECT_CREATE_INFORMATION { ULONG Attributes; //0x0 VOID* RootDirectory; //0x8 CHAR ProbeMode; //0x10 ULONG PagedPoolCharge; //0x14 ULONG NonPagedPoolCharge; //0x18 ULONG SecurityDescriptorCharge; //0x1c VOID* SecurityDescriptor; //0x20 struct _SECURITY_QUALITY_OF_SERVICE* SecurityQos; //0x28 struct _SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService; //0x30 }; ``` -------------------------------- ### Define _EXT_IOMMU_S1_X64_DOMAIN_SETTINGS structure Source: https://www.vergiliusproject.com/kernels/x64/windows-11/25h2/_EXT_IOMMU_S1_X64_DOMAIN_SETTINGS Definition of the _EXT_IOMMU_S1_X64_DOMAIN_SETTINGS structure, 0x10 bytes in size. The Flags bitfield includes EnableTranslation, Blocked, EnableDefaultPasid, FirstStagePagingMode, and Reserved bits. PageTableRoot is an 8-byte field at offset 0x8. Used by _EXT_IOMMU_DOMAIN_SETTINGS. ```c //0x10 bytes (sizeof) struct _EXT_IOMMU_S1_X64_DOMAIN_SETTINGS { struct { UCHAR EnableTranslation:1; //0x0 UCHAR Blocked:1; //0x0 UCHAR EnableDefaultPasid:1; //0x0 UCHAR FirstStagePagingMode:1; //0x0 UCHAR Reserved:4; //0x0 } Flags; //0x0 ULONGLONG PageTableRoot; //0x8 }; ``` -------------------------------- ### _ETW_GUID_ENTRY structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-10/22h2/_ETW_GUID_ENTRY Defines the _ETW_GUID_ENTRY structure with fields for GUID lists, reference count, GUID, registration list, security descriptor, enable info, filter data, silo state, host entry, lock, and lock owner. The structure is 0x1a8 bytes in size. ```c copy //0x1a8 bytes (sizeof) struct _ETW_GUID_ENTRY { struct _LIST_ENTRY GuidList; //0x0 struct _LIST_ENTRY SiloGuidList; //0x10 volatile LONGLONG RefCount; //0x20 struct _GUID Guid; //0x28 struct _LIST_ENTRY RegListHead; //0x38 VOID* SecurityDescriptor; //0x48 union { struct _ETW_LAST_ENABLE_INFO LastEnable; //0x50 ULONGLONG MatchId; //0x50 }; struct _TRACE_ENABLE_INFO ProviderEnableInfo; //0x60 struct _TRACE_ENABLE_INFO EnableInfo[8]; //0x80 struct _ETW_FILTER_HEADER* FilterData; //0x180 struct _ETW_SILODRIVERSTATE* SiloState; //0x188 struct _ETW_GUID_ENTRY* HostEntry; //0x190 struct _EX_PUSH_LOCK Lock; //0x198 struct _ETHREAD* LockOwner; //0x1a0 }; ``` -------------------------------- ### _EXT_IOMMU_FLUSH_CONTEXT structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-11/23h2/_EXT_IOMMU_FLUSH_CONTEXT Defines the _EXT_IOMMU_FLUSH_CONTEXT structure with a union containing Intel and AMD variants. The Intel variant has Status and PhysicalAddress fields, while the AMD variant has StatusAddr and OldStatus fields. The structure is 0x10 bytes in size. ```c //0x10 bytes (sizeof) struct _EXT_IOMMU_FLUSH_CONTEXT { union { struct { ULONG Status; //0x0 ULONGLONG PhysicalAddress; //0x8 } Intel; //0x0 struct { ULONGLONG* StatusAddr; //0x0 ULONGLONG OldStatus; //0x8 } Amd; //0x0 }; }; ``` -------------------------------- ### ETW Notification Type Enumeration Source: https://www.vergiliusproject.com/kernels/x64/windows-11/23h2/_ETW_NOTIFICATION_TYPE Defines the _ETW_NOTIFICATION_TYPE enum with 12 members, starting at 1. Used in _ETWP_NOTIFICATION_HEADER. ```c //0x4 bytes (sizeof) enum _ETW_NOTIFICATION_TYPE { EtwNotificationTypeNoReply = 1, EtwNotificationTypeLegacyEnable = 2, EtwNotificationTypeEnable = 3, EtwNotificationTypePrivateLogger = 4, EtwNotificationTypePerflib = 5, EtwNotificationTypeAudio = 6, EtwNotificationTypeSession = 7, EtwNotificationTypeReserved = 8, EtwNotificationTypeCredentialUI = 9, EtwNotificationTypeInProcSession = 10, EtwNotificationTypeFilteredPrivateLogger = 11, EtwNotificationTypeMax = 12 }; ``` -------------------------------- ### _OBJECT_CREATE_INFORMATION structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-vista/rtm/_OBJECT_CREATE_INFORMATION Defines the _OBJECT_CREATE_INFORMATION structure with fields for object attributes, root directory, parse context, probe mode, pool charges, security descriptor, and security quality of service. The structure is 0x48 bytes in size. ```c copy //0x48 bytes (sizeof) struct _OBJECT_CREATE_INFORMATION { ULONG Attributes; //0x0 VOID* RootDirectory; //0x8 VOID* ParseContext; //0x10 CHAR ProbeMode; //0x18 ULONG PagedPoolCharge; //0x1c ULONG NonPagedPoolCharge; //0x20 ULONG SecurityDescriptorCharge; //0x24 VOID* SecurityDescriptor; //0x28 struct _SECURITY_QUALITY_OF_SERVICE* SecurityQos; //0x30 struct _SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService; //0x38 }; ``` -------------------------------- ### _TlgProviderMetadata_t structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-10/21h1/_TlgProviderMetadata_t Defines the _TlgProviderMetadata_t structure with a Type field, a ProviderId GUID, and a RemainingSize field. The structure is 0x13 bytes in size. ```c //0x13 bytes (sizeof) struct _tlgProviderMetadata_t { UCHAR Type; //0x0 struct _GUID ProviderId; //0x1 USHORT RemainingSize; //0x11 }; ``` -------------------------------- ### _IO_CLIENT_EXTENSION structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-vista/rtm/_IO_CLIENT_EXTENSION Definition of the _IO_CLIENT_EXTENSION structure, 0x10 bytes in size, with NextExtension at offset 0x0 and ClientIdentificationAddress at offset 0x8. Used by _DRIVER_EXTENSION. ```c //0x10 bytes (sizeof) struct _IO_CLIENT_EXTENSION { struct _IO_CLIENT_EXTENSION* NextExtension; //0x0 VOID* ClientIdentificationAddress; //0x8 }; ``` -------------------------------- ### _HEAP_FREE_ENTRY structure definition (C) Source: https://www.vergiliusproject.com/kernels/x64/windows-vista/rtm/_HEAP_FREE_ENTRY Defines the 0x20-byte _HEAP_FREE_ENTRY structure used by the Windows heap manager. Includes unions for the standard header fields (PreviousBlockPrivateData, Size, Flags, SmallTagIndex, PreviousSize, SegmentOffset/LFHFlags, UnusedBytes) and an alternative interceptor layout with Reserved, FunctionIndex/ContextValue, InterceptorValue, UnusedBytesLength, EntryOffset, and ExtendedBlockSignature. ```c //0x20 bytes (sizeof) struct _HEAP_FREE_ENTRY { union { struct { VOID* PreviousBlockPrivateData; //0x0 union { struct { USHORT Size; //0x8 UCHAR Flags; //0xa UCHAR SmallTagIndex; //0xb USHORT PreviousSize; //0xc union { UCHAR SegmentOffset; //0xe UCHAR LFHFlags; //0xe }; UCHAR UnusedBytes; //0xf }; ULONGLONG CompactHeader; //0x8 }; }; struct { VOID* Reserved; //0x0 union { struct { USHORT FunctionIndex; //0x8 USHORT ContextValue; //0xa }; ULONG InterceptorValue; //0x8 }; USHORT UnusedBytesLength; //0xc UCHAR EntryOffset; //0xe UCHAR ExtendedBlockSignature; //0xf }; }; } //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes (sizeof) //0x20 bytes ``` -------------------------------- ### _HEAP_FAILURE_TYPE enumeration definition Source: https://www.vergiliusproject.com/kernels/x64/windows-8/rtm/_HEAP_FAILURE_TYPE Defines the _HEAP_FAILURE_TYPE enum with 15 failure types, starting at 0. The comment indicates the size is 4 bytes. ```c //0x4 bytes (sizeof) enum _HEAP_FAILURE_TYPE { heap_failure_internal = 0, heap_failure_unknown = 1, heap_failure_generic = 2, heap_failure_entry_corruption = 3, heap_failure_multiple_entries_corruption = 4, heap_failure_virtual_block_corruption = 5, heap_failure_buffer_overrun = 6, heap_failure_buffer_underrun = 7, heap_failure_block_not_busy = 8, heap_failure_invalid_argument = 9, heap_failure_usage_after_free = 10, heap_failure_cross_heap_operation = 11, heap_failure_freelists_corruption = 12, heap_failure_listentry_corruption = 13, heap_failure_lfh_bitmap_mismatch = 14 }; ``` -------------------------------- ### _MI_VERIFIER_DRIVER_ENTRY structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-vista/rtm/_MI_VERIFIER_DRIVER_ENTRY C structure definition for _MI_VERIFIER_DRIVER_ENTRY, 0xa0 bytes in size. Includes fields for tracking driver loads/unloads, base name, start/end addresses, flags, signature, pool page headers, pool trackers, and pool allocation statistics. ```c copy //0xa0 bytes (sizeof) struct _MI_VERIFIER_DRIVER_ENTRY { struct _LIST_ENTRY Links; //0x0 ULONG Loads; //0x10 ULONG Unloads; //0x14 struct _UNICODE_STRING BaseName; //0x18 VOID* StartAddress; //0x28 VOID* EndAddress; //0x30 ULONG Flags; //0x38 ULONGLONG Signature; //0x40 union _SLIST_HEADER PoolPageHeaders; //0x50 union _SLIST_HEADER PoolTrackers; //0x60 ULONG CurrentPagedPoolAllocations; //0x70 ULONG CurrentNonPagedPoolAllocations; //0x74 ULONG PeakPagedPoolAllocations; //0x78 ULONG PeakNonPagedPoolAllocations; //0x7c ULONGLONG PagedBytes; //0x80 ULONGLONG NonPagedBytes; //0x88 struct _MI_VERIFIER_DRIVER_ENTRY* Next; //0x90 struct _MI_VERIFIER_DRIVER_ENTRY* Prev; //0x98 };//sizeof:0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0=0) (0xa0=160) (0x0= ``` -------------------------------- ### _VF_ADDRESS_RANGE structure definition Source: https://www.vergiliusproject.com/kernels/x64/windows-7/sp1/_VF_ADDRESS_RANGE Defines the _VF_ADDRESS_RANGE structure with Start and End pointer fields. The structure is 0x10 bytes in size. Used by _VI_DEADLOCK_GLOBALS. ```c copy //0x10 bytes (sizeof) struct _VF_ADDRESS_RANGE { UCHAR* Start; //0x0 UCHAR* End; //0x8 }; ```