/* Version definitions */ #undef NTDDI_VERSION #define NTDDI_VERSION NTDDI_WIN10 #undef _WIN32_WINNT #define _WIN32_WINNT _WIN32_WINNT_WIN10 #include #include #define C_ASSERT_FIELD(Type, Offset, MemberType, MemberName) C_ASSERT(FIELD_OFFSET(Type, MemberName) == Offset); /* KTHREAD */ C_ASSERT_FIELD(KTHREAD, 0x000, DISPATCHER_HEADER, Header) C_ASSERT_FIELD(KTHREAD, 0x010, PVOID, SListFaultAddress) C_ASSERT_FIELD(KTHREAD, 0x018, UINT64, QuantumTarget) C_ASSERT_FIELD(KTHREAD, 0x020, PVOID, InitialStack) C_ASSERT_FIELD(KTHREAD, 0x024, PVOID, StackLimit) C_ASSERT_FIELD(KTHREAD, 0x028, PVOID, StackBase) C_ASSERT_FIELD(KTHREAD, 0x02C, ULONG32, ThreadLock) C_ASSERT_FIELD(KTHREAD, 0x030, UINT64, CycleTime) C_ASSERT_FIELD(KTHREAD, 0x038, ULONG32, HighCycleTime) C_ASSERT_FIELD(KTHREAD, 0x03C, PVOID, ServiceTable) C_ASSERT_FIELD(KTHREAD, 0x040, ULONG32, CurrentRunTime) C_ASSERT_FIELD(KTHREAD, 0x044, ULONG32, ExpectedRunTime) C_ASSERT_FIELD(KTHREAD, 0x048, PVOID, KernelStack) C_ASSERT_FIELD(KTHREAD, 0x04C, XSAVE_FORMAT*, StateSaveArea) C_ASSERT_FIELD(KTHREAD, 0x050, KSCHEDULING_GROUP*, SchedulingGroup) C_ASSERT_FIELD(KTHREAD, 0x054, KWAIT_STATUS_REGISTER, WaitRegister) C_ASSERT_FIELD(KTHREAD, 0x055, UINT8, Running) C_ASSERT_FIELD(KTHREAD, 0x056, UINT8[2], Alerted) C_ASSERT_FIELD(KTHREAD, 0x058, LONG32, MiscFlags) C_ASSERT_FIELD(KTHREAD, 0x05C, LONG32, ThreadFlags) C_ASSERT_FIELD(KTHREAD, 0x060, UINT8, Tag) C_ASSERT_FIELD(KTHREAD, 0x061, UINT8, SystemHeteroCpuPolicy) C_ASSERT_FIELD(KTHREAD, 0x063, UINT8, Spare0) C_ASSERT_FIELD(KTHREAD, 0x064, ULONG32, SystemCallNumber) C_ASSERT_FIELD(KTHREAD, 0x068, PVOID, FirstArgument) C_ASSERT_FIELD(KTHREAD, 0x06C, KTRAP_FRAME*, TrapFrame) C_ASSERT_FIELD(KTHREAD, 0x070, KAPC_STATE, ApcState) C_ASSERT_FIELD(KTHREAD, 0x088, ULONG32, UserIdealProcessor) C_ASSERT_FIELD(KTHREAD, 0x08C, ULONG32, ContextSwitches) C_ASSERT_FIELD(KTHREAD, 0x090, UINT8, State) C_ASSERT_FIELD(KTHREAD, 0x091, CHAR, Spare12) C_ASSERT_FIELD(KTHREAD, 0x092, UINT8, WaitIrql) C_ASSERT_FIELD(KTHREAD, 0x093, CHAR, WaitMode) C_ASSERT_FIELD(KTHREAD, 0x094, LONG32, WaitStatus) C_ASSERT_FIELD(KTHREAD, 0x098, KWAIT_BLOCK*, WaitBlockList) C_ASSERT_FIELD(KTHREAD, 0x09C, LIST_ENTRY, WaitListEntry) C_ASSERT_FIELD(KTHREAD, 0x09C, SINGLE_LIST_ENTRY, SwapListEntry) C_ASSERT_FIELD(KTHREAD, 0x0A4, DISPATCHER_HEADER*, Queue) C_ASSERT_FIELD(KTHREAD, 0x0A8, PVOID, Teb) C_ASSERT_FIELD(KTHREAD, 0x0B0, UINT64, RelativeTimerBias) C_ASSERT_FIELD(KTHREAD, 0x0B8, KTIMER, Timer) C_ASSERT_FIELD(KTHREAD, 0x0E0, KWAIT_BLOCK[4], WaitBlock) C_ASSERT_FIELD(KTHREAD, 0x0F4, KTHREAD_COUNTERS*, ThreadCounters) C_ASSERT_FIELD(KTHREAD, 0x10C, XSTATE_SAVE*, XStateSave) C_ASSERT_FIELD(KTHREAD, 0x124, PVOID, Win32Thread) C_ASSERT_FIELD(KTHREAD, 0x138, ULONG32, WaitTime) C_ASSERT_FIELD(KTHREAD, 0x13C, INT16, KernelApcDisable) C_ASSERT_FIELD(KTHREAD, 0x13E, INT16, SpecialApcDisable) C_ASSERT_FIELD(KTHREAD, 0x13C, ULONG32, CombinedApcDisable) C_ASSERT_FIELD(KTHREAD, 0x140, LIST_ENTRY, QueueListEntry) C_ASSERT_FIELD(KTHREAD, 0x148, ULONG32, NextProcessor) C_ASSERT_FIELD(KTHREAD, 0x14C, LONG32, QueuePriority) C_ASSERT_FIELD(KTHREAD, 0x150, KPROCESS*, Process) C_ASSERT_FIELD(KTHREAD, 0x154, GROUP_AFFINITY, UserAffinity) C_ASSERT_FIELD(KTHREAD, 0x15A, CHAR, PreviousMode) C_ASSERT_FIELD(KTHREAD, 0x15B, CHAR, BasePriority) C_ASSERT_FIELD(KTHREAD, 0x15C, CHAR, PriorityDecrement) C_ASSERT_FIELD(KTHREAD, 0x15D, UINT8, Preempted) C_ASSERT_FIELD(KTHREAD, 0x15E, UINT8, AdjustReason) C_ASSERT_FIELD(KTHREAD, 0x15F, CHAR, AdjustIncrement) C_ASSERT_FIELD(KTHREAD, 0x160, ULONG32, AffinityVersion) C_ASSERT_FIELD(KTHREAD, 0x164, GROUP_AFFINITY, Affinity) C_ASSERT_FIELD(KTHREAD, 0x16A, UINT8, ApcStateIndex) C_ASSERT_FIELD(KTHREAD, 0x16B, UINT8, WaitBlockCount) C_ASSERT_FIELD(KTHREAD, 0x16C, ULONG32, IdealProcessor) C_ASSERT_FIELD(KTHREAD, 0x174, KAPC_STATE, SavedApcState) C_ASSERT_FIELD(KTHREAD, 0x18B, UINT8, WaitReason) C_ASSERT_FIELD(KTHREAD, 0x18C, CHAR, SuspendCount) C_ASSERT_FIELD(KTHREAD, 0x18D, CHAR, Saturation) C_ASSERT_FIELD(KTHREAD, 0x18E, UINT16, SListFaultCount) C_ASSERT_FIELD(KTHREAD, 0x190, KAPC, SchedulerApc) C_ASSERT_FIELD(KTHREAD, 0x191, UINT8, ResourceIndex) C_ASSERT_FIELD(KTHREAD, 0x193, UINT8, QuantumReset) C_ASSERT_FIELD(KTHREAD, 0x194, ULONG32, KernelTime) C_ASSERT_FIELD(KTHREAD, 0x1B4, KPRCB*, WaitPrcb) C_ASSERT_FIELD(KTHREAD, 0x1B8, PVOID, LegoData) C_ASSERT_FIELD(KTHREAD, 0x1BF, UINT8, CallbackNestingLevel) C_ASSERT_FIELD(KTHREAD, 0x1C0, ULONG32, UserTime) C_ASSERT_FIELD(KTHREAD, 0x1C4, KEVENT, SuspendEvent) C_ASSERT_FIELD(KTHREAD, 0x1D4, LIST_ENTRY, ThreadListEntry) C_ASSERT_FIELD(KTHREAD, 0x1DC, LIST_ENTRY, MutantListHead) C_ASSERT_FIELD(KTHREAD, 0x1E4, UINT8, AbEntrySummary) C_ASSERT_FIELD(KTHREAD, 0x1E5, UINT8, AbWaitEntryCount) C_ASSERT_FIELD(KTHREAD, 0x1E6, UINT16, Spare20) C_ASSERT_FIELD(KTHREAD, 0x1E8, KLOCK_ENTRY[6], LockEntries) C_ASSERT_FIELD(KTHREAD, 0x308, SINGLE_LIST_ENTRY, PropagateBoostsEntry) C_ASSERT_FIELD(KTHREAD, 0x30C, SINGLE_LIST_ENTRY, IoSelfBoostsEntry) C_ASSERT_FIELD(KTHREAD, 0x310, UINT8[16], PriorityFloorCounts) C_ASSERT_FIELD(KTHREAD, 0x320, ULONG32, PriorityFloorSummary) C_ASSERT_FIELD(KTHREAD, 0x324, LONG32, AbCompletedIoBoostCount) C_ASSERT_FIELD(KTHREAD, 0x328, INT16, KeReferenceCount) C_ASSERT_FIELD(KTHREAD, 0x32A, UINT8, AbOrphanedEntrySummary) C_ASSERT_FIELD(KTHREAD, 0x32B, UINT8, AbOwnedEntryCount) C_ASSERT_FIELD(KTHREAD, 0x32C, ULONG32, ForegroundLossTime) C_ASSERT_FIELD(KTHREAD, 0x330, LIST_ENTRY, GlobalForegroundListEntry) C_ASSERT_FIELD(KTHREAD, 0x330, SINGLE_LIST_ENTRY, ForegroundDpcStackListEntry) C_ASSERT_FIELD(KTHREAD, 0x334, ULONG32, InGlobalForegroundList) C_ASSERT_FIELD(KTHREAD, 0x338, KSCB*, QueuedScb) C_ASSERT_FIELD(KTHREAD, 0x340, UINT64, NpxState)