From 5dfdff5570c6d9d6cd92c4f6debbeee002b2edea Mon Sep 17 00:00:00 2001 From: "mike.auty@gmail.com" Date: Thu, 15 Mar 2012 22:35:56 +0000 Subject: [PATCH] Regenerate all profiles based on the latest pdbparse. Ensures all bitfields include their nativetype. --- .../overlays/windows/vista_sp0_x64_vtypes.py | 1228 ++++----- .../overlays/windows/vista_sp0_x86_vtypes.py | 1060 ++++---- .../overlays/windows/vista_sp1_x64_vtypes.py | 1572 ++++++------ .../overlays/windows/vista_sp1_x86_vtypes.py | 1382 +++++------ .../overlays/windows/vista_sp2_x64_vtypes.py | 1582 ++++++------ .../overlays/windows/vista_sp2_x86_vtypes.py | 1382 +++++------ .../windows/win2003_sp0_x86_vtypes.py | 1170 ++++----- .../windows/win2003_sp1_x64_vtypes.py | 750 +++--- .../windows/win2003_sp1_x86_vtypes.py | 1228 +++++---- .../windows/win2003_sp2_x64_vtypes.py | 802 +++--- .../windows/win2003_sp2_x86_vtypes.py | 2196 ++++++++--------- .../overlays/windows/win7_sp0_x64_vtypes.py | 1652 ++++++------- .../overlays/windows/win7_sp0_x86_vtypes.py | 1474 +++++------ .../overlays/windows/win7_sp1_x64_vtypes.py | 1660 ++++++------- .../overlays/windows/win7_sp1_x86_vtypes.py | 1480 +++++------ .../overlays/windows/xp_sp2_x86_vtypes.py | 1924 +++++---------- .../overlays/windows/xp_sp3_x86_vtypes.py | 1272 +++++----- 17 files changed, 11453 insertions(+), 12361 deletions(-) diff --git a/volatility/plugins/overlays/windows/vista_sp0_x64_vtypes.py b/volatility/plugins/overlays/windows/vista_sp0_x64_vtypes.py index ceda3a34..5e6a1695 100644 --- a/volatility/plugins/overlays/windows/vista_sp0_x64_vtypes.py +++ b/volatility/plugins/overlays/windows/vista_sp0_x64_vtypes.py @@ -28,8 +28,8 @@ ntkrnlmp_types = { 'QuadPart' : [ 0x0, ['long long']], } ], '__unnamed_103d' : [ 0x4, { - 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Private' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_103f' : [ 0x4, { 'Flags' : [ 0x0, ['unsigned long']], @@ -289,14 +289,14 @@ ntkrnlmp_types = { 'WaitStatus' : [ 0x80, ['long long']], 'WaitBlockList' : [ 0x88, ['pointer64', ['_KWAIT_BLOCK']]], 'GateObject' : [ 0x88, ['pointer64', ['_KGATE']]], - 'KernelStackResident' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadyTransition' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessReadyQueue' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WaitNext' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemAffinityActive' : [ 0x90, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Alertable' : [ 0x90, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'GdiFlushActive' : [ 0x90, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Reserved' : [ 0x90, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'KernelStackResident' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessReadyQueue' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WaitNext' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x90, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Alertable' : [ 0x90, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GdiFlushActive' : [ 0x90, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Reserved' : [ 0x90, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x90, ['long']], 'WaitReason' : [ 0x94, ['unsigned char']], 'SwapBusy' : [ 0x95, ['unsigned char']], @@ -307,16 +307,16 @@ ntkrnlmp_types = { 'Teb' : [ 0xb0, ['pointer64', ['void']]], 'Timer' : [ 0xb8, ['_KTIMER']], 'TimerFill' : [ 0xb8, ['array', 60, ['unsigned char']]], - 'AutoAlignment' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwStackTraceApc1Inserted' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EtwStackTraceApc2Inserted' : [ 0xf4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CycleChargePending' : [ 0xf4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'CalloutActive' : [ 0xf4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ApcQueueable' : [ 0xf4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'EnableStackSwap' : [ 0xf4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'GuiThread' : [ 0xf4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'ReservedFlags' : [ 0xf4, ['BitField', dict(start_bit = 9, end_bit = 32)]], + 'AutoAlignment' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'EtwStackTraceApc1Inserted' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EtwStackTraceApc2Inserted' : [ 0xf4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CycleChargePending' : [ 0xf4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CalloutActive' : [ 0xf4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ApcQueueable' : [ 0xf4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0xf4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'GuiThread' : [ 0xf4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xf4, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], 'ThreadFlags' : [ 0xf4, ['long']], 'WaitBlock' : [ 0xf8, ['array', 4, ['_KWAIT_BLOCK']]], 'WaitBlockFill0' : [ 0xf8, ['array', 43, ['unsigned char']]], @@ -409,21 +409,21 @@ ntkrnlmp_types = { 'OldIrql' : [ 0x30, ['unsigned long']], } ], '__unnamed_1115' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 25)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 64)]], - 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 61)]], - 'Region' : [ 0x8, ['BitField', dict(start_bit = 61, end_bit = 64)]], + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 25, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 61, native_type='unsigned long long')]], + 'Region' : [ 0x8, ['BitField', dict(start_bit = 61, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_111a' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], - 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], } ], '_SLIST_HEADER' : [ 0x10, { 'Alignment' : [ 0x0, ['unsigned long long']], @@ -453,11 +453,11 @@ ntkrnlmp_types = { 'Information' : [ 0x8, ['unsigned long long']], } ], '_EX_PUSH_LOCK' : [ 0x8, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], 'Ptr' : [ 0x0, ['pointer64', ['void']]], } ], @@ -494,7 +494,7 @@ ntkrnlmp_types = { } ], '_EX_FAST_REF' : [ 0x8, { 'Object' : [ 0x0, ['pointer64', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], } ], '_EX_PUSH_LOCK_WAIT_BLOCK' : [ 0x40, { @@ -538,45 +538,45 @@ ntkrnlmp_types = { 'ReadClusterSize' : [ 0x410, ['unsigned long']], 'MmLockOrdering' : [ 0x414, ['long']], 'CrossThreadFlags' : [ 0x418, ['unsigned long']], - 'Terminated' : [ 0x418, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ThreadInserted' : [ 0x418, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x418, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x418, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x418, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x418, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x418, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x418, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x418, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyTokenOnOpen' : [ 0x418, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ThreadIoPriority' : [ 0x418, ['BitField', dict(start_bit = 10, end_bit = 13)]], - 'ThreadPagePriority' : [ 0x418, ['BitField', dict(start_bit = 13, end_bit = 16)]], - 'RundownFail' : [ 0x418, ['BitField', dict(start_bit = 16, end_bit = 17)]], + 'Terminated' : [ 0x418, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x418, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x418, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x418, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x418, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x418, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x418, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x418, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x418, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x418, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x418, ['BitField', dict(start_bit = 10, end_bit = 13, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x418, ['BitField', dict(start_bit = 13, end_bit = 16, native_type='unsigned long')]], + 'RundownFail' : [ 0x418, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x41c, ['unsigned long']], - 'ActiveExWorker' : [ 0x41c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x41c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x41c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ClonedThread' : [ 0x41c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'KeyedEventInUse' : [ 0x41c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RateApcState' : [ 0x41c, ['BitField', dict(start_bit = 5, end_bit = 7)]], - 'SelfTerminate' : [ 0x41c, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveExWorker' : [ 0x41c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x41c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x41c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x41c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x41c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RateApcState' : [ 0x41c, ['BitField', dict(start_bit = 5, end_bit = 7, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x41c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x420, ['unsigned long']], - 'Spare' : [ 0x420, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'StartAddressInvalid' : [ 0x420, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwPageFaultCalloutActive' : [ 0x420, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x420, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemWorkingSetShared' : [ 0x420, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x421, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsProcessAddressSpaceExclusive' : [ 0x421, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsProcessAddressSpaceShared' : [ 0x421, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SuppressSymbolLoad' : [ 0x421, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Prefetching' : [ 0x421, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsDynamicMemoryShared' : [ 0x421, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsChangeControlAreaExclusive' : [ 0x421, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsChangeControlAreaShared' : [ 0x421, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'PriorityRegionActive' : [ 0x422, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'Spare' : [ 0x420, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x420, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EtwPageFaultCalloutActive' : [ 0x420, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x420, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemWorkingSetShared' : [ 0x420, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x421, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceExclusive' : [ 0x421, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x421, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x421, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Prefetching' : [ 0x421, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsDynamicMemoryShared' : [ 0x421, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsChangeControlAreaExclusive' : [ 0x421, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsChangeControlAreaShared' : [ 0x421, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'PriorityRegionActive' : [ 0x422, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], 'CacheManagerActive' : [ 0x424, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x425, ['unsigned char']], 'ActiveFaultCount' : [ 0x426, ['unsigned char']], @@ -603,7 +603,7 @@ ntkrnlmp_types = { 'DebugPort' : [ 0x150, ['pointer64', ['void']]], 'ExceptionPortData' : [ 0x158, ['pointer64', ['void']]], 'ExceptionPortValue' : [ 0x158, ['unsigned long long']], - 'ExceptionPortState' : [ 0x158, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'ExceptionPortState' : [ 0x158, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], 'ObjectTable' : [ 0x160, ['pointer64', ['_HANDLE_TABLE']]], 'Token' : [ 0x168, ['_EX_FAST_REF']], 'WorkingSetPage' : [ 0x170, ['unsigned long long']], @@ -658,51 +658,51 @@ ntkrnlmp_types = { 'MmProcessLinks' : [ 0x358, ['_LIST_ENTRY']], 'ModifiedPageCount' : [ 0x368, ['unsigned long']], 'Flags2' : [ 0x36c, ['unsigned long']], - 'JobNotReallyActive' : [ 0x36c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AccountingFolded' : [ 0x36c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'NewProcessReported' : [ 0x36c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ExitProcessReported' : [ 0x36c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReportCommitChanges' : [ 0x36c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LastReportMemory' : [ 0x36c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ReportPhysicalPageChanges' : [ 0x36c, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'HandleTableRundown' : [ 0x36c, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'NeedsHandleRundown' : [ 0x36c, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RefTraceEnabled' : [ 0x36c, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'NumaAware' : [ 0x36c, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtectedProcess' : [ 0x36c, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'DefaultPagePriority' : [ 0x36c, ['BitField', dict(start_bit = 12, end_bit = 15)]], - 'PrimaryTokenFrozen' : [ 0x36c, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessVerifierTarget' : [ 0x36c, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'StackRandomizationDisabled' : [ 0x36c, ['BitField', dict(start_bit = 17, end_bit = 18)]], + 'JobNotReallyActive' : [ 0x36c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x36c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x36c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x36c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x36c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x36c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ReportPhysicalPageChanges' : [ 0x36c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'HandleTableRundown' : [ 0x36c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x36c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x36c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'NumaAware' : [ 0x36c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtectedProcess' : [ 0x36c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x36c, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x36c, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x36c, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x36c, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], 'Flags' : [ 0x370, ['unsigned long']], - 'CreateReported' : [ 0x370, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x370, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x370, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x370, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x370, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x370, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x370, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x370, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x370, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x370, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x370, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x370, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x370, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'DeprioritizeViews' : [ 0x370, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x370, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x370, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x370, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x370, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x370, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x370, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x370, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x370, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x370, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x370, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'SmapAllowed' : [ 0x370, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'ProcessInserted' : [ 0x370, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x370, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'SparePsFlags1' : [ 0x370, ['BitField', dict(start_bit = 30, end_bit = 32)]], + 'CreateReported' : [ 0x370, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x370, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x370, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x370, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x370, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x370, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x370, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x370, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x370, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x370, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x370, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x370, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x370, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x370, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x370, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x370, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x370, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x370, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x370, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x370, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x370, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x370, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x370, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x370, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SmapAllowed' : [ 0x370, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x370, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x370, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'SparePsFlags1' : [ 0x370, ['BitField', dict(start_bit = 30, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x374, ['long']], 'Spare7' : [ 0x378, ['unsigned short']], 'SubSystemMinorVersion' : [ 0x37a, ['unsigned char']], @@ -1178,10 +1178,10 @@ ntkrnlmp_types = { 'ThreadListHead' : [ 0x70, ['_LIST_ENTRY']], 'ProcessLock' : [ 0x80, ['unsigned long long']], 'Affinity' : [ 0x88, ['unsigned long long']], - 'AutoAlignment' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ReservedFlags' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'AutoAlignment' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ReservedFlags' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='long')]], 'ProcessFlags' : [ 0x90, ['long']], 'BasePriority' : [ 0x94, ['unsigned char']], 'QuantumReset' : [ 0x95, ['unsigned char']], @@ -1212,8 +1212,8 @@ ntkrnlmp_types = { 'u' : [ 0x0, ['__unnamed_13f3']], } ], '_PTE_QUEUE_POINTER' : [ 0x8, { - 'PointerPte' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 48)]], - 'TimeStamp' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'PointerPte' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 48, native_type='long long')]], + 'TimeStamp' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], 'Data' : [ 0x0, ['long long']], } ], '__unnamed_140c' : [ 0x10, { @@ -1276,12 +1276,12 @@ ntkrnlmp_types = { 'e3' : [ 0x0, ['__unnamed_1430']], } ], '__unnamed_143a' : [ 0x8, { - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 52)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55)]], - 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 52, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57, native_type='unsigned long long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58, native_type='unsigned long long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64, native_type='unsigned long long')]], } ], '_MMPFN' : [ 0x30, { 'u1' : [ 0x0, ['__unnamed_1428']], @@ -1367,10 +1367,10 @@ ntkrnlmp_types = { 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], 'WritableUserReferences' : [ 0x4, ['long']], - 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30)]], - 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30, native_type='unsigned long')]], + 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubsectionRoot' : [ 0x8, ['pointer64', ['_MM_SUBSECTION_AVL_TABLE']]], 'SeImageStub' : [ 0x8, ['pointer64', ['_MI_IMAGE_SECURITY_REFERENCE']]], } ], @@ -1406,11 +1406,11 @@ ntkrnlmp_types = { 'Bitmap' : [ 0x58, ['pointer64', ['_RTL_BITMAP']]], 'BitmapHint' : [ 0x60, ['unsigned long']], 'LastAllocationSize' : [ 0x64, ['unsigned long']], - 'PageFileNumber' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'BootPartition' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Spare0' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 16)]], - 'AdriftMdls' : [ 0x6a, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare1' : [ 0x6a, ['BitField', dict(start_bit = 1, end_bit = 16)]], + 'PageFileNumber' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'BootPartition' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Spare0' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x6a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare1' : [ 0x6a, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], 'FileHandle' : [ 0x70, ['pointer64', ['void']]], 'AvailableList' : [ 0x80, ['_SLIST_HEADER']], 'NeedProcessingList' : [ 0x90, ['_SLIST_HEADER']], @@ -1420,7 +1420,7 @@ ntkrnlmp_types = { 'FreeBit' : [ 0x8, ['unsigned long']], } ], '__unnamed_14ae' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMVAD']]], } ], '__unnamed_14b1' : [ 0x8, { @@ -1443,9 +1443,9 @@ ntkrnlmp_types = { } ], '_MM_AVL_TABLE' : [ 0x40, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'NodeHint' : [ 0x30, ['pointer64', ['void']]], 'NodeFreeHint' : [ 0x38, ['pointer64', ['void']]], } ], @@ -1474,7 +1474,7 @@ ntkrnlmp_types = { 'ColorNode' : [ 0xa, ['unsigned short']], } ], '__unnamed_14d0' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x28, { @@ -1500,7 +1500,7 @@ ntkrnlmp_types = { 'NumberOfFullSectors' : [ 0x30, ['unsigned long']], } ], '__unnamed_14db' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMADDRESS_NODE']]], 'NextToFree' : [ 0x0, ['pointer64', ['_MI_PER_SESSION_PROTOS']]], } ], @@ -1705,17 +1705,17 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0x17e0, ['pointer64', ['void']]], 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'DbgSafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgInDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgHasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgSkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgWerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgRanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DbgSuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 16)]], + 'DbgSafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgInDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgHasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgSkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgWerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgRanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgSuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0x17f0, ['pointer64', ['void']]], 'TxnScopeExitCallback' : [ 0x17f8, ['pointer64', ['void']]], 'TxnScopeContext' : [ 0x1800, ['pointer64', ['void']]], @@ -1769,9 +1769,9 @@ ntkrnlmp_types = { } ], '__unnamed_15c8' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'PStateDomain' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PStateDomainIdleAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'PStateDomain' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'PStateDomainIdleAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], '_PROCESSOR_POWER_STATE' : [ 0x138, { 'IdleFunction' : [ 0x0, ['pointer64', ['void']]], @@ -2557,19 +2557,19 @@ ntkrnlmp_types = { 'BufferSequenceNumber' : [ 0x310, ['long long']], 'AcceptNewEvents' : [ 0x318, ['long']], 'Flags' : [ 0x31c, ['unsigned long']], - 'Persistent' : [ 0x31c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoLogger' : [ 0x31c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'FsReady' : [ 0x31c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RealTime' : [ 0x31c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow' : [ 0x31c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelTrace' : [ 0x31c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'NoMoreEnable' : [ 0x31c, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Persistent' : [ 0x31c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x31c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x31c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x31c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x31c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x31c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x31c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], 'RequestFlag' : [ 0x320, ['unsigned long']], - 'RequestNewFie' : [ 0x320, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'RequestUpdateFile' : [ 0x320, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'RequestFlush' : [ 0x320, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RequestDisableRealtime' : [ 0x320, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RequestDisconnectConsumer' : [ 0x320, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'RequestNewFie' : [ 0x320, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RequestUpdateFile' : [ 0x320, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'RequestFlush' : [ 0x320, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RequestDisableRealtime' : [ 0x320, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequestDisconnectConsumer' : [ 0x320, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], 'StackTraceFilterHookCount' : [ 0x324, ['unsigned short']], 'StackTraceFilter' : [ 0x326, ['array', 16, ['unsigned short']]], } ], @@ -2696,17 +2696,17 @@ ntkrnlmp_types = { '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x8, { 'ImpersonationData' : [ 0x0, ['unsigned long long']], 'ImpersonationToken' : [ 0x0, ['pointer64', ['void']]], - 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], } ], '_MMVAD_FLAGS3' : [ 0x8, { - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], - 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24)]], - 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'LargePageCreating' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33)]], - 'Spare3' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64)]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned long long')]], + 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24, native_type='unsigned long long')]], + 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long long')]], + 'LargePageCreating' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'Spare3' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64, native_type='unsigned long long')]], } ], '_MI_VERIFIER_POOL_HEADER' : [ 0x8, { 'VerifierPoolEntry' : [ 0x0, ['pointer64', ['_VI_POOL_ENTRY']]], @@ -2771,22 +2771,22 @@ ntkrnlmp_types = { 'Request' : [ 0x28, ['_PORT_MESSAGE']], } ], '_HARDWARE_PTE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_DUAL' : [ 0x278, { 'Length' : [ 0x0, ['unsigned long']], @@ -2915,7 +2915,7 @@ ntkrnlmp_types = { 'DebugInfo' : [ 0x38, ['pointer64', ['_HANDLE_TRACE_DEBUG_INFO']]], 'ExtraInfoPages' : [ 0x40, ['long']], 'Flags' : [ 0x44, ['unsigned long']], - 'StrictFIFO' : [ 0x44, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x44, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], 'FirstFreeHandle' : [ 0x48, ['long']], 'LastFreeHandleEntry' : [ 0x50, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], 'HandleCount' : [ 0x58, ['long']], @@ -2928,15 +2928,15 @@ ntkrnlmp_types = { 'NumberOfBytes' : [ 0x10, ['unsigned long long']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_VI_CANCEL_GLOBALS' : [ 0x78, { 'CancelLock' : [ 0x0, ['unsigned long long']], @@ -2990,13 +2990,13 @@ ntkrnlmp_types = { 'Reserved4' : [ 0x1a0, ['array', 96, ['unsigned char']]], } ], '_MMPTE_PROTOTYPE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_THERMAL_INFORMATION_EX' : [ 0x58, { 'ThermalStamp' : [ 0x0, ['unsigned long']], @@ -3012,15 +3012,15 @@ ntkrnlmp_types = { 'S4TransitionTripPoint' : [ 0x54, ['unsigned long']], } ], '__unnamed_18ac' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], } ], '__unnamed_18ae' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], } ], '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { 'File' : [ 0x0, ['__unnamed_18ac']], @@ -3032,14 +3032,14 @@ ntkrnlmp_types = { 'Parameters' : [ 0x10, ['array', 2, ['unsigned long long']]], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16)]], - 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16)]], + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], } ], '_EXCEPTION_POINTERS' : [ 0x10, { 'ExceptionRecord' : [ 0x0, ['pointer64', ['_EXCEPTION_RECORD']]], @@ -3136,9 +3136,9 @@ ntkrnlmp_types = { 'u4' : [ 0x70, ['__unnamed_18dc']], } ], '_MMWSLE_FREE_ENTRY' : [ 0x8, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], - 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_NT_TIB' : [ 0x38, { 'ExceptionList' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], @@ -3196,9 +3196,9 @@ ntkrnlmp_types = { } ], '__unnamed_18ee' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], 'PPM_IDLE_STATES' : [ 0x48, { 'Type' : [ 0x0, ['unsigned long']], @@ -3215,11 +3215,11 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['pointer64', ['void']]], 'ImageBaseAddress' : [ 0x10, ['pointer64', ['void']]], 'Ldr' : [ 0x18, ['pointer64', ['_PEB_LDR_DATA']]], @@ -3230,9 +3230,9 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x40, ['pointer64', ['void']]], 'IFEOKey' : [ 0x48, ['pointer64', ['void']]], 'CrossProcessFlags' : [ 0x50, ['unsigned long']], - 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x58, ['pointer64', ['void']]], 'UserSharedInfoPtr' : [ 0x58, ['pointer64', ['void']]], 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], @@ -3298,8 +3298,8 @@ ntkrnlmp_types = { 'PcatInformation' : [ 0x0, ['_PCAT_FIRMWARE_INFORMATION']], } ], '_FIRMWARE_INFORMATION_LOADER_BLOCK' : [ 0x20, { - 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'u' : [ 0x8, ['__unnamed_1908']], } ], '_HEAP_UCR_DESCRIPTOR' : [ 0x30, { @@ -3356,9 +3356,9 @@ ntkrnlmp_types = { 'PostList' : [ 0x10, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x20, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x28, ['pointer64', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x38, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_KINTERRUPT' : [ 0xa0, { @@ -3498,22 +3498,22 @@ ntkrnlmp_types = { 'LastExceptionFromRip' : [ 0x4c8, ['unsigned long long']], } ], '_MMPTE_HARDWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x10, { 'Port' : [ 0x0, ['pointer64', ['void']]], @@ -3626,13 +3626,13 @@ ntkrnlmp_types = { 'RmLock' : [ 0x80, ['pointer64', ['_ERESOURCE']]], } ], '_MMVAD_FLAGS' : [ 0x8, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51, native_type='unsigned long long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63, native_type='unsigned long long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_MMWSLE_HASH' : [ 0x4, { 'Index' : [ 0x0, ['unsigned long']], @@ -3689,10 +3689,10 @@ ntkrnlmp_types = { } ], '_VF_TRACKER_STAMP' : [ 0x10, { 'Thread' : [ 0x0, ['pointer64', ['void']]], - 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], } ], '_VI_TRACK_IRQL' : [ 0x38, { 'Thread' : [ 0x0, ['pointer64', ['void']]], @@ -3730,11 +3730,11 @@ ntkrnlmp_types = { } ], '_CM_KEY_CONTROL_BLOCK' : [ 0x100, { 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x8, ['unsigned long']], 'NextHash' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], @@ -3755,10 +3755,10 @@ ntkrnlmp_types = { 'KcbMaxNameLen' : [ 0x98, ['unsigned short']], 'KcbMaxValueNameLen' : [ 0x9a, ['unsigned short']], 'KcbMaxValueDataLen' : [ 0x9c, ['unsigned long']], - 'KcbUserFlags' : [ 0xa0, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'KcbVirtControlFlags' : [ 0xa0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'KcbDebug' : [ 0xa0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Flags' : [ 0xa0, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'KcbUserFlags' : [ 0xa0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0xa0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0xa0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0xa0, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'RealKeyName' : [ 0xa8, ['pointer64', ['unsigned char']]], 'KCBUoWListHead' : [ 0xb0, ['_LIST_ENTRY']], 'TransKCBOwner' : [ 0xc0, ['pointer64', ['_CM_TRANS']]], @@ -3769,14 +3769,14 @@ ntkrnlmp_types = { 'FullKCBName' : [ 0xf8, ['pointer64', ['_UNICODE_STRING']]], } ], '_MMPTE_SOFTWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_CACHE_UNINITIALIZE_EVENT' : [ 0x20, { 'Next' : [ 0x0, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], @@ -3802,9 +3802,9 @@ ntkrnlmp_types = { } ], '_MM_SUBSECTION_AVL_TABLE' : [ 0x38, { 'BalancedRoot' : [ 0x0, ['_MMSUBSECTION_NODE']], - 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'NodeHint' : [ 0x30, ['pointer64', ['void']]], } ], '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { @@ -3830,17 +3830,17 @@ ntkrnlmp_types = { 'DataValueHigh' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], - 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEGMENT_OBJECT' : [ 0x40, { 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], @@ -3890,28 +3890,28 @@ ntkrnlmp_types = { 'DataLength' : [ 0x10, ['unsigned long']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SessionMaster' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'TrimmerAttached' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'TrimmerDetaching' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Available' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SessionMaster' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'TrimmerAttached' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'TrimmerDetaching' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Available' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], } ], '__unnamed_1a07' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'UsingHypervisor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'UsingHypervisor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], } ], 'PPM_PERF_STATES' : [ 0x80, { 'Count' : [ 0x0, ['unsigned long']], @@ -4137,17 +4137,17 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'DbgSafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgInDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgHasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgSkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgWerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgRanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DbgSuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 16)]], + 'DbgSafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgInDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgHasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgSkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgWerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgRanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgSuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], @@ -4287,25 +4287,25 @@ ntkrnlmp_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -4408,14 +4408,14 @@ ntkrnlmp_types = { 'Info' : [ 0xd0, ['_THERMAL_INFORMATION_EX']], } ], '_MMPTE_LIST' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_VI_POOL_PAGE_HEADER' : [ 0x18, { 'NextPage' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], @@ -4510,10 +4510,10 @@ ntkrnlmp_types = { } ], '__unnamed_1b1e' : [ 0x1, { 'AsUCHAR' : [ 0x0, ['unsigned char']], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], } ], 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { 'Revision' : [ 0x0, ['unsigned long']], @@ -4543,16 +4543,16 @@ ntkrnlmp_types = { 'DeviceListHead' : [ 0x8, ['_LIST_ENTRY']], 'Lock' : [ 0x18, ['unsigned long long']], 'Busy' : [ 0x20, ['unsigned char']], - 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='long long')]], + 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='long long')]], } ], '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], 'ContextAsUlong' : [ 0x0, ['unsigned long']], } ], '_KPROCESSOR_STATE' : [ 0x5b0, { @@ -4576,13 +4576,13 @@ ntkrnlmp_types = { 'ActualLimit' : [ 0x20, ['unsigned long long']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], } ], '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { 'Present' : [ 0x0, ['unsigned long long']], @@ -4609,14 +4609,14 @@ ntkrnlmp_types = { 'Reserved' : [ 0x14, ['unsigned long']], } ], '_MMWSLENTRY' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], } ], '_WOW64_PROCESS' : [ 0x8, { 'Wow64' : [ 0x0, ['pointer64', ['void']]], @@ -4656,11 +4656,11 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['unsigned long']], 'ImageBaseAddress' : [ 0x8, ['unsigned long']], 'Ldr' : [ 0xc, ['unsigned long']], @@ -4671,9 +4671,9 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x20, ['unsigned long']], 'IFEOKey' : [ 0x24, ['unsigned long']], 'CrossProcessFlags' : [ 0x28, ['unsigned long']], - 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x2c, ['unsigned long']], 'UserSharedInfoPtr' : [ 0x2c, ['unsigned long']], 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], @@ -4811,12 +4811,12 @@ ntkrnlmp_types = { 'StartPerfClock' : [ 0x8, ['_LARGE_INTEGER']], } ], '_MMPTE_SUBSECTION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_POWER_STATE' : [ 0x4, { 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], @@ -4920,22 +4920,22 @@ ntkrnlmp_types = { 'ReserveDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], } ], '_MMPTE_HARDWARE_LARGEPAGE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PAT' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 21)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 40)]], - 'reserved2' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PAT' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 21, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 40, native_type='unsigned long long')]], + 'reserved2' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 64, native_type='unsigned long long')]], } ], '_KUSER_SHARED_DATA' : [ 0x3b8, { 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], @@ -4971,12 +4971,12 @@ ntkrnlmp_types = { 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], 'SafeBootMode' : [ 0x2ec, ['unsigned char']], 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], - 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 32)]], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], 'SystemCall' : [ 0x300, ['unsigned long']], 'SystemCallReturn' : [ 0x304, ['unsigned long']], @@ -5013,7 +5013,7 @@ ntkrnlmp_types = { 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], } ], '__unnamed_1bd0' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMSUBSECTION_NODE']]], } ], '_MMSUBSECTION_NODE' : [ 0x28, { @@ -5044,16 +5044,16 @@ ntkrnlmp_types = { 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], } ], '_WHEA_ERROR_STATUS' : [ 0x8, { - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], } ], '_FS_FILTER_CALLBACKS' : [ 0x68, { 'SizeOfFsFilterCallbacks' : [ 0x0, ['unsigned long']], @@ -5230,12 +5230,12 @@ ntkrnlmp_types = { '_OBJECT_TYPE_INITIALIZER' : [ 0x70, { 'Length' : [ 0x0, ['unsigned short']], 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], - 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6)]], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], 'ObjectTypeCode' : [ 0x4, ['unsigned long']], 'InvalidAttributes' : [ 0x8, ['unsigned long']], 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], @@ -5422,10 +5422,10 @@ ntkrnlmp_types = { '_IMAGE_SECURITY_CONTEXT' : [ 0x8, { 'PageHashes' : [ 0x0, ['pointer64', ['void']]], 'Value' : [ 0x0, ['unsigned long long']], - 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64)]], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_1cb0' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], @@ -5499,8 +5499,8 @@ ntkrnlmp_types = { 'FirmwareDescriptorListHead' : [ 0x68, ['_LIST_ENTRY']], 'AcpiTable' : [ 0x78, ['pointer64', ['void']]], 'AcpiTableSize' : [ 0x80, ['unsigned long']], - 'BootViaWinload' : [ 0x84, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x84, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'BootViaWinload' : [ 0x84, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x84, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'LoaderPerformanceData' : [ 0x88, ['pointer64', ['_LOADER_PERFORMANCE_DATA']]], 'BootApplicationPersistentData' : [ 0x90, ['_LIST_ENTRY']], 'WmdTestResult' : [ 0xa0, ['pointer64', ['void']]], @@ -5670,10 +5670,10 @@ ntkrnlmp_types = { 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], } ], '_POOL_HEADER' : [ 0x10, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'ProcessBilled' : [ 0x8, ['pointer64', ['_EPROCESS']]], @@ -5691,11 +5691,11 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['unsigned long long']], 'ImageBaseAddress' : [ 0x10, ['unsigned long long']], 'Ldr' : [ 0x18, ['unsigned long long']], @@ -5706,9 +5706,9 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x40, ['unsigned long long']], 'IFEOKey' : [ 0x48, ['unsigned long long']], 'CrossProcessFlags' : [ 0x50, ['unsigned long']], - 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x58, ['unsigned long long']], 'UserSharedInfoPtr' : [ 0x58, ['unsigned long long']], 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], @@ -5837,8 +5837,8 @@ ntkrnlmp_types = { } ], '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x10, { 'Process' : [ 0x0, ['pointer64', ['_EPROCESS']]], - 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_CLIENT_ID' : [ 0x10, { 'UniqueProcess' : [ 0x0, ['pointer64', ['void']]], @@ -5852,8 +5852,8 @@ ntkrnlmp_types = { } ], '_VI_DEADLOCK_RESOURCE' : [ 0xf8, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer64', ['void']]], 'ThreadOwner' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x18, ['_LIST_ENTRY']], @@ -5871,33 +5871,33 @@ ntkrnlmp_types = { 'Length' : [ 0x10, ['unsigned long']], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], } ], '_SECURITY_CLIENT_CONTEXT' : [ 0x48, { 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], @@ -6078,9 +6078,9 @@ ntkrnlmp_types = { } ], '__unnamed_1dd3' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { 'Revision' : [ 0x0, ['unsigned short']], @@ -6228,10 +6228,10 @@ ntkrnlmp_types = { 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], 'Security' : [ 0x2c, ['unsigned long']], 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'MaxClassLen' : [ 0x38, ['unsigned long']], 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], 'MaxValueDataLen' : [ 0x40, ['unsigned long']], @@ -6291,16 +6291,16 @@ ntkrnlmp_types = { 'Buffer' : [ 0x4, ['unsigned long']], } ], '_WHEA_PCIX_BUS_VALIDATION_BITS' : [ 0x8, { - 'ErrorStatusValid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ErrorTypeValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BusIdValid' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'BusAddressValid' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'BusDataValid' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'CommandValid' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RequestorIdValid' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'CompleterIdValid' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'TargetIdValid' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 64)]], + 'ErrorStatusValid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'ErrorTypeValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'BusIdValid' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'BusAddressValid' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'BusDataValid' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'CommandValid' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'RequestorIdValid' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'CompleterIdValid' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'TargetIdValid' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 64, native_type='unsigned long long')]], } ], '_KSYSTEM_TIME' : [ 0xc, { 'LowPart' : [ 0x0, ['unsigned long']], @@ -6431,18 +6431,18 @@ ntkrnlmp_types = { 'TimeRefreshLockAcquired' : [ 0x2b4, ['unsigned char']], } ], '_SEGMENT_FLAGS' : [ 0x8, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22)]], - 'ContainsPxeSubsection' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 63)]], - 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22, native_type='unsigned long long')]], + 'ContainsPxeSubsection' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 63, native_type='unsigned long long')]], + 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_EX_WORK_QUEUE' : [ 0x58, { 'WorkerQueue' : [ 0x0, ['_KQUEUE']], @@ -6534,17 +6534,17 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], - 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0xfca, ['unsigned short']], - 'DbgSafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgInDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgHasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgSkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgWerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgRanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DbgSuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 16)]], + 'DbgSafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgInDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgHasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgSkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgWerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgRanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgSuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], @@ -6821,11 +6821,11 @@ ntkrnlmp_types = { 'TransactionHistoryCount' : [ 0x260, ['unsigned long']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], } ], '_CM_KCB_UOW' : [ 0x60, { 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -6850,24 +6850,24 @@ ntkrnlmp_types = { 'ThisVolatileKeyCell' : [ 0x58, ['unsigned long']], } ], '_MMPTE_TRANSITION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 64, native_type='unsigned long long')]], } ], '_KREQUEST_PACKET' : [ 0x20, { 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer64', ['void']]]], 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_CM_KEY_SECURITY_CACHE' : [ 0x38, { 'Cell' : [ 0x0, ['unsigned long']], @@ -6884,19 +6884,19 @@ ntkrnlmp_types = { 'Name' : [ 0x12, ['array', 1, ['wchar']]], } ], '_MMSECURE_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12, native_type='unsigned long')]], } ], '_PO_IRP_QUEUE' : [ 0x10, { 'CurrentIrp' : [ 0x0, ['pointer64', ['_IRP']]], 'PendingIrpList' : [ 0x8, ['pointer64', ['_IRP']]], } ], '__unnamed_1ecb' : [ 0x4, { - 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'Whole' : [ 0x0, ['unsigned long']], } ], '_VI_DEADLOCK_NODE' : [ 0xd0, { @@ -6986,11 +6986,11 @@ ntkrnlmp_types = { 'Reserved' : [ 0x30, ['array', 3, ['unsigned long']]], } ], '_WHEA_PERSISTENCE_INFO' : [ 0x8, { - 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 46)]], - 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 46, end_bit = 48)]], - 'Signature' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 46, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 46, end_bit = 48, native_type='unsigned long long')]], + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '_MI_SECTION_IMAGE_INFORMATION' : [ 0x48, { 'ExportedImageInformation' : [ 0x0, ['_SECTION_IMAGE_INFORMATION']], @@ -6999,15 +6999,15 @@ ntkrnlmp_types = { '_PCIE_DEVICE_ID' : [ 0x10, { 'VendorID' : [ 0x0, ['unsigned short']], 'DeviceID' : [ 0x2, ['unsigned short']], - 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Segment' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 24)]], - 'PrimaryBusNumber' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'SecondaryBusNumber' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 10)]], - 'SlotNumber' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 24)]], - 'Reserved2' : [ 0xc, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Segment' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 24, native_type='unsigned long')]], + 'PrimaryBusNumber' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'SecondaryBusNumber' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 10, native_type='unsigned long')]], + 'SlotNumber' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 24, native_type='unsigned long')]], + 'Reserved2' : [ 0xc, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_HEAP_USERDATA_HEADER' : [ 0x20, { 'SFreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], @@ -7032,12 +7032,12 @@ ntkrnlmp_types = { 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], } ], '_WHEA_PCIX_DEV_VALIDATION_BITS' : [ 0x8, { - 'ErrorStatusValid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IdInfoValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryNumberValid' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IoNumberValid' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RegisterDataPairValid' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 64)]], + 'ErrorStatusValid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'IdInfoValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'MemoryNumberValid' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'IoNumberValid' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'RegisterDataPairValid' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 64, native_type='unsigned long long')]], } ], '_DEFERRED_WRITE' : [ 0x50, { 'NodeTypeCode' : [ 0x0, ['short']], @@ -7078,10 +7078,10 @@ ntkrnlmp_types = { 'Machine' : [ 0x30, ['unsigned short']], 'ImageContainsCode' : [ 0x32, ['unsigned char']], 'ImageFlags' : [ 0x33, ['unsigned char']], - 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], 'LoaderFlags' : [ 0x34, ['unsigned long']], 'ImageFileSize' : [ 0x38, ['unsigned long']], 'CheckSum' : [ 0x3c, ['unsigned long']], @@ -7295,10 +7295,10 @@ ntkrnlmp_types = { 'TotalPhysicalMemoryCount' : [ 0x120, ['unsigned long']], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'BATTERY_REPORTING_SCALE' : [ 0x8, { @@ -7328,13 +7328,13 @@ ntkrnlmp_types = { 'HiberFileResumeTime' : [ 0x58, ['unsigned long long']], } ], '_DEVICE_FLAGS' : [ 0x4, { - 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], } ], '_RTL_BALANCED_LINKS' : [ 0x20, { 'Parent' : [ 0x0, ['pointer64', ['_RTL_BALANCED_LINKS']]], @@ -7345,18 +7345,18 @@ ntkrnlmp_types = { } ], '_MMVIEW' : [ 0x10, { 'Entry' : [ 0x0, ['unsigned long long']], - 'Writable' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Writable' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], 'ControlArea' : [ 0x8, ['pointer64', ['_CONTROL_AREA']]], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x30, { 'Type' : [ 0x0, ['unsigned short']], @@ -7571,11 +7571,11 @@ ntkrnlmp_types = { '_KIDTENTRY64' : [ 0x10, { 'OffsetLow' : [ 0x0, ['unsigned short']], 'Selector' : [ 0x2, ['unsigned short']], - 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned short')]], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned short')]], + 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned short')]], + 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], 'OffsetMiddle' : [ 0x6, ['unsigned short']], 'OffsetHigh' : [ 0x8, ['unsigned long']], 'Reserved1' : [ 0xc, ['unsigned long']], @@ -7616,16 +7616,16 @@ ntkrnlmp_types = { 'BaseHigh' : [ 0x3, ['unsigned char']], } ], '__unnamed_1fde' : [ 0x4, { - 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_KGDTENTRY64' : [ 0x10, { 'LimitLow' : [ 0x0, ['unsigned short']], diff --git a/volatility/plugins/overlays/windows/vista_sp0_x86_vtypes.py b/volatility/plugins/overlays/windows/vista_sp0_x86_vtypes.py index 61c7d5b6..0d12e742 100644 --- a/volatility/plugins/overlays/windows/vista_sp0_x86_vtypes.py +++ b/volatility/plugins/overlays/windows/vista_sp0_x86_vtypes.py @@ -1,4 +1,4 @@ -nt_types = { +ntkrnlmp_types = { 'LIST_ENTRY64' : [ 0x10, { 'Flink' : [ 0x0, ['unsigned long long']], 'Blink' : [ 0x8, ['unsigned long long']], @@ -28,8 +28,8 @@ nt_types = { 'QuadPart' : [ 0x0, ['long long']], } ], '__unnamed_1037' : [ 0x4, { - 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Private' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1039' : [ 0x4, { 'Flags' : [ 0x0, ['unsigned long']], @@ -347,14 +347,14 @@ nt_types = { 'WaitStatus' : [ 0x60, ['long']], 'WaitBlockList' : [ 0x64, ['pointer', ['_KWAIT_BLOCK']]], 'GateObject' : [ 0x64, ['pointer', ['_KGATE']]], - 'KernelStackResident' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadyTransition' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessReadyQueue' : [ 0x68, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WaitNext' : [ 0x68, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemAffinityActive' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Alertable' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'GdiFlushActive' : [ 0x68, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Reserved' : [ 0x68, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'KernelStackResident' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessReadyQueue' : [ 0x68, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WaitNext' : [ 0x68, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Alertable' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GdiFlushActive' : [ 0x68, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Reserved' : [ 0x68, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x68, ['long']], 'WaitReason' : [ 0x6c, ['unsigned char']], 'SwapBusy' : [ 0x6d, ['unsigned char']], @@ -369,16 +369,16 @@ nt_types = { 'Teb' : [ 0x84, ['pointer', ['void']]], 'Timer' : [ 0x88, ['_KTIMER']], 'TimerFill' : [ 0x88, ['array', 40, ['unsigned char']]], - 'AutoAlignment' : [ 0xb0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xb0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwStackTraceApc1Inserted' : [ 0xb0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EtwStackTraceApc2Inserted' : [ 0xb0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CycleChargePending' : [ 0xb0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'CalloutActive' : [ 0xb0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ApcQueueable' : [ 0xb0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'EnableStackSwap' : [ 0xb0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'GuiThread' : [ 0xb0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'ReservedFlags' : [ 0xb0, ['BitField', dict(start_bit = 9, end_bit = 32)]], + 'AutoAlignment' : [ 0xb0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0xb0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'EtwStackTraceApc1Inserted' : [ 0xb0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EtwStackTraceApc2Inserted' : [ 0xb0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CycleChargePending' : [ 0xb0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CalloutActive' : [ 0xb0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ApcQueueable' : [ 0xb0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0xb0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'GuiThread' : [ 0xb0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xb0, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], 'ThreadFlags' : [ 0xb0, ['long']], 'WaitBlock' : [ 0xb8, ['array', 4, ['_KWAIT_BLOCK']]], 'WaitBlockFill0' : [ 0xb8, ['array', 23, ['unsigned char']]], @@ -474,11 +474,11 @@ nt_types = { 'Information' : [ 0x4, ['unsigned long']], } ], '_EX_PUSH_LOCK' : [ 0x4, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -515,7 +515,7 @@ nt_types = { } ], '_EX_FAST_REF' : [ 0x4, { 'Object' : [ 0x0, ['pointer', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], } ], '_EX_PUSH_LOCK_WAIT_BLOCK' : [ 0x30, { @@ -559,45 +559,45 @@ nt_types = { 'ReadClusterSize' : [ 0x258, ['unsigned long']], 'MmLockOrdering' : [ 0x25c, ['long']], 'CrossThreadFlags' : [ 0x260, ['unsigned long']], - 'Terminated' : [ 0x260, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ThreadInserted' : [ 0x260, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x260, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x260, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x260, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x260, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x260, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x260, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x260, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyTokenOnOpen' : [ 0x260, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ThreadIoPriority' : [ 0x260, ['BitField', dict(start_bit = 10, end_bit = 13)]], - 'ThreadPagePriority' : [ 0x260, ['BitField', dict(start_bit = 13, end_bit = 16)]], - 'RundownFail' : [ 0x260, ['BitField', dict(start_bit = 16, end_bit = 17)]], + 'Terminated' : [ 0x260, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x260, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x260, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x260, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x260, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x260, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x260, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x260, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x260, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x260, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x260, ['BitField', dict(start_bit = 10, end_bit = 13, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x260, ['BitField', dict(start_bit = 13, end_bit = 16, native_type='unsigned long')]], + 'RundownFail' : [ 0x260, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x264, ['unsigned long']], - 'ActiveExWorker' : [ 0x264, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x264, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x264, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ClonedThread' : [ 0x264, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'KeyedEventInUse' : [ 0x264, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RateApcState' : [ 0x264, ['BitField', dict(start_bit = 5, end_bit = 7)]], - 'SelfTerminate' : [ 0x264, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveExWorker' : [ 0x264, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x264, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x264, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x264, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x264, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RateApcState' : [ 0x264, ['BitField', dict(start_bit = 5, end_bit = 7, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x264, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x268, ['unsigned long']], - 'Spare' : [ 0x268, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'StartAddressInvalid' : [ 0x268, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwPageFaultCalloutActive' : [ 0x268, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x268, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemWorkingSetShared' : [ 0x268, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x269, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsProcessAddressSpaceExclusive' : [ 0x269, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsProcessAddressSpaceShared' : [ 0x269, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SuppressSymbolLoad' : [ 0x269, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Prefetching' : [ 0x269, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsDynamicMemoryShared' : [ 0x269, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsChangeControlAreaExclusive' : [ 0x269, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsChangeControlAreaShared' : [ 0x269, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'PriorityRegionActive' : [ 0x26a, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'Spare' : [ 0x268, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x268, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EtwPageFaultCalloutActive' : [ 0x268, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x268, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemWorkingSetShared' : [ 0x268, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x269, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceExclusive' : [ 0x269, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x269, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x269, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Prefetching' : [ 0x269, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsDynamicMemoryShared' : [ 0x269, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsChangeControlAreaExclusive' : [ 0x269, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsChangeControlAreaShared' : [ 0x269, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'PriorityRegionActive' : [ 0x26a, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], 'CacheManagerActive' : [ 0x26c, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x26d, ['unsigned char']], 'ActiveFaultCount' : [ 0x26e, ['unsigned char']], @@ -624,7 +624,7 @@ nt_types = { 'DebugPort' : [ 0xd4, ['pointer', ['void']]], 'ExceptionPortData' : [ 0xd8, ['pointer', ['void']]], 'ExceptionPortValue' : [ 0xd8, ['unsigned long']], - 'ExceptionPortState' : [ 0xd8, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'ExceptionPortState' : [ 0xd8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'ObjectTable' : [ 0xdc, ['pointer', ['_HANDLE_TABLE']]], 'Token' : [ 0xe0, ['_EX_FAST_REF']], 'WorkingSetPage' : [ 0xe4, ['unsigned long']], @@ -679,51 +679,51 @@ nt_types = { 'MmProcessLinks' : [ 0x218, ['_LIST_ENTRY']], 'ModifiedPageCount' : [ 0x220, ['unsigned long']], 'Flags2' : [ 0x224, ['unsigned long']], - 'JobNotReallyActive' : [ 0x224, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AccountingFolded' : [ 0x224, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'NewProcessReported' : [ 0x224, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ExitProcessReported' : [ 0x224, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReportCommitChanges' : [ 0x224, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LastReportMemory' : [ 0x224, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ReportPhysicalPageChanges' : [ 0x224, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'HandleTableRundown' : [ 0x224, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'NeedsHandleRundown' : [ 0x224, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RefTraceEnabled' : [ 0x224, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'NumaAware' : [ 0x224, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtectedProcess' : [ 0x224, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'DefaultPagePriority' : [ 0x224, ['BitField', dict(start_bit = 12, end_bit = 15)]], - 'PrimaryTokenFrozen' : [ 0x224, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessVerifierTarget' : [ 0x224, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'StackRandomizationDisabled' : [ 0x224, ['BitField', dict(start_bit = 17, end_bit = 18)]], + 'JobNotReallyActive' : [ 0x224, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x224, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x224, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x224, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x224, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x224, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ReportPhysicalPageChanges' : [ 0x224, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'HandleTableRundown' : [ 0x224, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x224, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x224, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'NumaAware' : [ 0x224, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtectedProcess' : [ 0x224, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x224, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x224, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x224, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x224, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], 'Flags' : [ 0x228, ['unsigned long']], - 'CreateReported' : [ 0x228, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x228, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x228, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x228, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x228, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x228, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x228, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x228, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x228, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x228, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x228, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x228, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x228, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'DeprioritizeViews' : [ 0x228, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x228, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x228, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x228, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x228, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x228, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x228, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x228, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x228, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x228, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x228, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'SmapAllowed' : [ 0x228, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'ProcessInserted' : [ 0x228, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x228, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'SparePsFlags1' : [ 0x228, ['BitField', dict(start_bit = 30, end_bit = 32)]], + 'CreateReported' : [ 0x228, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x228, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x228, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x228, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x228, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x228, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x228, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x228, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x228, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x228, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x228, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x228, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x228, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x228, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x228, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x228, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x228, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x228, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x228, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x228, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x228, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x228, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x228, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x228, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SmapAllowed' : [ 0x228, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x228, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x228, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'SparePsFlags1' : [ 0x228, ['BitField', dict(start_bit = 30, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x22c, ['long']], 'Spare7' : [ 0x230, ['unsigned short']], 'SubSystemMinorVersion' : [ 0x232, ['unsigned char']], @@ -1202,10 +1202,10 @@ nt_types = { 'ThreadListHead' : [ 0x50, ['_LIST_ENTRY']], 'ProcessLock' : [ 0x58, ['unsigned long']], 'Affinity' : [ 0x5c, ['unsigned long']], - 'AutoAlignment' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x60, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0x60, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ReservedFlags' : [ 0x60, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'AutoAlignment' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x60, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x60, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ReservedFlags' : [ 0x60, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='long')]], 'ProcessFlags' : [ 0x60, ['long']], 'BasePriority' : [ 0x64, ['unsigned char']], 'QuantumReset' : [ 0x65, ['unsigned char']], @@ -1334,10 +1334,10 @@ nt_types = { 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], 'WritableUserReferences' : [ 0x4, ['long']], - 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30)]], - 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30, native_type='unsigned long')]], + 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubsectionRoot' : [ 0x8, ['pointer', ['_MM_SUBSECTION_AVL_TABLE']]], 'SeImageStub' : [ 0x8, ['pointer', ['_MI_IMAGE_SECURITY_REFERENCE']]], } ], @@ -1391,11 +1391,11 @@ nt_types = { 'e3' : [ 0x0, ['__unnamed_146a']], } ], '__unnamed_1471' : [ 0x4, { - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25)]], - 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], } ], '_MMPFN' : [ 0x18, { 'u1' : [ 0x0, ['__unnamed_1463']], @@ -1420,11 +1420,11 @@ nt_types = { 'Bitmap' : [ 0x2c, ['pointer', ['_RTL_BITMAP']]], 'BitmapHint' : [ 0x30, ['unsigned long']], 'LastAllocationSize' : [ 0x34, ['unsigned long']], - 'PageFileNumber' : [ 0x38, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'BootPartition' : [ 0x38, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Spare0' : [ 0x38, ['BitField', dict(start_bit = 5, end_bit = 16)]], - 'AdriftMdls' : [ 0x3a, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare1' : [ 0x3a, ['BitField', dict(start_bit = 1, end_bit = 16)]], + 'PageFileNumber' : [ 0x38, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'BootPartition' : [ 0x38, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Spare0' : [ 0x38, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x3a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare1' : [ 0x3a, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], 'FileHandle' : [ 0x3c, ['pointer', ['void']]], 'AvailableList' : [ 0x40, ['_SLIST_HEADER']], 'NeedProcessingList' : [ 0x48, ['_SLIST_HEADER']], @@ -1438,7 +1438,7 @@ nt_types = { 'Buffer' : [ 0x4, ['pointer', ['unsigned long']]], } ], '__unnamed_14a3' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMVAD']]], } ], '__unnamed_14a6' : [ 0x4, { @@ -1461,9 +1461,9 @@ nt_types = { } ], '_MM_AVL_TABLE' : [ 0x20, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'NodeHint' : [ 0x18, ['pointer', ['void']]], 'NodeFreeHint' : [ 0x1c, ['pointer', ['void']]], } ], @@ -1492,7 +1492,7 @@ nt_types = { 'ColorNode' : [ 0x6, ['unsigned short']], } ], '__unnamed_14c5' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x14, { @@ -1518,7 +1518,7 @@ nt_types = { 'NumberOfFullSectors' : [ 0x1c, ['unsigned long']], } ], '__unnamed_14d0' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMADDRESS_NODE']]], 'NextToFree' : [ 0x0, ['pointer', ['_MI_PER_SESSION_PROTOS']]], } ], @@ -1704,17 +1704,17 @@ nt_types = { 'MergedPrefLanguages' : [ 0xfc0, ['pointer', ['void']]], 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], - 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0xfca, ['unsigned short']], - 'DbgSafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgInDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgHasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgSkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgWerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgRanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DbgSuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 16)]], + 'DbgSafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgInDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgHasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgSkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgWerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgRanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgSuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0xfcc, ['pointer', ['void']]], 'TxnScopeExitCallback' : [ 0xfd0, ['pointer', ['void']]], 'TxnScopeContext' : [ 0xfd4, ['pointer', ['void']]], @@ -1764,9 +1764,9 @@ nt_types = { } ], '__unnamed_15bd' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'PStateDomain' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PStateDomainIdleAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'PStateDomain' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'PStateDomainIdleAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], '_PROCESSOR_POWER_STATE' : [ 0xe0, { 'IdleFunction' : [ 0x0, ['pointer', ['void']]], @@ -1812,9 +1812,9 @@ nt_types = { 'PreviousTrapFrame' : [ 0x0, ['pointer', ['_KTRAP_FRAME']]], 'PreviousExceptionList' : [ 0x0, ['pointer', ['void']]], 'StackControlFlags' : [ 0x4, ['unsigned long']], - 'PreviousLargeStack' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousSegmentsPresent' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ExpandCalloutStack' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'PreviousLargeStack' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousSegmentsPresent' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ExpandCalloutStack' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'Previous' : [ 0x8, ['_KERNEL_STACK_SEGMENT']], } ], '_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x2c, { @@ -2475,19 +2475,19 @@ nt_types = { 'BufferSequenceNumber' : [ 0x238, ['long long']], 'AcceptNewEvents' : [ 0x240, ['long']], 'Flags' : [ 0x244, ['unsigned long']], - 'Persistent' : [ 0x244, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoLogger' : [ 0x244, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'FsReady' : [ 0x244, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RealTime' : [ 0x244, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow' : [ 0x244, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelTrace' : [ 0x244, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'NoMoreEnable' : [ 0x244, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Persistent' : [ 0x244, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x244, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x244, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x244, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x244, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x244, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x244, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], 'RequestFlag' : [ 0x248, ['unsigned long']], - 'RequestNewFie' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'RequestUpdateFile' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'RequestFlush' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RequestDisableRealtime' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RequestDisconnectConsumer' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'RequestNewFie' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RequestUpdateFile' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'RequestFlush' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RequestDisableRealtime' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequestDisconnectConsumer' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], 'StackTraceFilterHookCount' : [ 0x24c, ['unsigned short']], 'StackTraceFilter' : [ 0x24e, ['array', 16, ['unsigned short']]], } ], @@ -2614,15 +2614,15 @@ nt_types = { '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x4, { 'ImpersonationData' : [ 0x0, ['unsigned long']], 'ImpersonationToken' : [ 0x0, ['pointer', ['void']]], - 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], } ], '_MMVAD_FLAGS3' : [ 0x4, { - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], - 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24)]], - 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned long')]], + 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24, native_type='unsigned long')]], + 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_MI_VERIFIER_POOL_HEADER' : [ 0x4, { 'VerifierPoolEntry' : [ 0x0, ['pointer', ['_VI_POOL_ENTRY']]], @@ -2686,19 +2686,19 @@ nt_types = { 'Request' : [ 0x18, ['_PORT_MESSAGE']], } ], '_HARDWARE_PTE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_DUAL' : [ 0x13c, { 'Length' : [ 0x0, ['unsigned long']], @@ -2733,8 +2733,8 @@ nt_types = { 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], 'FileOffset' : [ 0x0, ['unsigned long long']], 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], - 'DontUse0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'DontUse0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'PointerProtoPte' : [ 0x4, ['pointer', ['void']]], } ], '_HEAP_COUNTERS' : [ 0x48, { @@ -2819,7 +2819,7 @@ nt_types = { 'DebugInfo' : [ 0x1c, ['pointer', ['_HANDLE_TRACE_DEBUG_INFO']]], 'ExtraInfoPages' : [ 0x20, ['long']], 'Flags' : [ 0x24, ['unsigned long']], - 'StrictFIFO' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], 'FirstFreeHandle' : [ 0x28, ['long']], 'LastFreeHandleEntry' : [ 0x2c, ['pointer', ['_HANDLE_TABLE_ENTRY']]], 'HandleCount' : [ 0x30, ['long']], @@ -2832,15 +2832,15 @@ nt_types = { 'NumberOfBytes' : [ 0xc, ['unsigned long']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_VI_CANCEL_GLOBALS' : [ 0x6c, { 'CancelLock' : [ 0x0, ['unsigned long']], @@ -2876,11 +2876,11 @@ nt_types = { 'ContextListHead' : [ 0x28, ['_LIST_ENTRY']], } ], '_MMPTE_PROTOTYPE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 9)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 9, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_THERMAL_INFORMATION_EX' : [ 0x50, { 'ThermalStamp' : [ 0x0, ['unsigned long']], @@ -2896,15 +2896,15 @@ nt_types = { 'S4TransitionTripPoint' : [ 0x4c, ['unsigned long']], } ], '__unnamed_188f' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], } ], '__unnamed_1891' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], } ], '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { 'File' : [ 0x0, ['__unnamed_188f']], @@ -2916,14 +2916,14 @@ nt_types = { 'Parameters' : [ 0x8, ['array', 2, ['unsigned long']]], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16)]], - 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16)]], + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], } ], '_EXCEPTION_POINTERS' : [ 0x8, { 'ExceptionRecord' : [ 0x0, ['pointer', ['_EXCEPTION_RECORD']]], @@ -3020,9 +3020,9 @@ nt_types = { 'u4' : [ 0x38, ['__unnamed_18bf']], } ], '_MMWSLE_FREE_ENTRY' : [ 0x4, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 12)]], - 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 12, native_type='unsigned long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_NT_TIB' : [ 0x1c, { 'ExceptionList' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], @@ -3080,9 +3080,9 @@ nt_types = { } ], '__unnamed_18ce' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], 'PPM_IDLE_STATES' : [ 0x3c, { 'Type' : [ 0x0, ['unsigned long']], @@ -3099,11 +3099,11 @@ nt_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['pointer', ['void']]], 'ImageBaseAddress' : [ 0x8, ['pointer', ['void']]], 'Ldr' : [ 0xc, ['pointer', ['_PEB_LDR_DATA']]], @@ -3114,9 +3114,9 @@ nt_types = { 'AtlThunkSListPtr' : [ 0x20, ['pointer', ['void']]], 'IFEOKey' : [ 0x24, ['pointer', ['void']]], 'CrossProcessFlags' : [ 0x28, ['unsigned long']], - 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x2c, ['pointer', ['void']]], 'UserSharedInfoPtr' : [ 0x2c, ['pointer', ['void']]], 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], @@ -3182,8 +3182,8 @@ nt_types = { 'PcatInformation' : [ 0x0, ['_PCAT_FIRMWARE_INFORMATION']], } ], '_FIRMWARE_INFORMATION_LOADER_BLOCK' : [ 0x14, { - 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'u' : [ 0x4, ['__unnamed_18e8']], } ], '_HEAP_UCR_DESCRIPTOR' : [ 0x18, { @@ -3199,16 +3199,16 @@ nt_types = { 'BaseHi' : [ 0x3, ['unsigned char']], } ], '__unnamed_18f5' : [ 0x4, { - 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_18f7' : [ 0x4, { 'Bytes' : [ 0x0, ['__unnamed_18ef']], @@ -3267,9 +3267,9 @@ nt_types = { 'PostList' : [ 0x8, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x10, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x14, ['pointer', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_KINTERRUPT' : [ 0x270, { @@ -3368,19 +3368,19 @@ nt_types = { 'ExtendedRegisters' : [ 0xcc, ['array', 512, ['unsigned char']]], } ], '_MMPTE_HARDWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x8, { 'Port' : [ 0x0, ['pointer', ['void']]], @@ -3493,13 +3493,13 @@ nt_types = { 'RmLock' : [ 0x50, ['pointer', ['_ERESOURCE']]], } ], '_MMVAD_FLAGS' : [ 0x4, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_MMWSLE_HASH' : [ 0x4, { 'Index' : [ 0x0, ['unsigned long']], @@ -3549,10 +3549,10 @@ nt_types = { } ], '_VF_TRACKER_STAMP' : [ 0x8, { 'Thread' : [ 0x0, ['pointer', ['void']]], - 'Flags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'OldIrql' : [ 0x5, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'NewIrql' : [ 0x6, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Processor' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Flags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x5, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0x6, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], } ], '_VI_TRACK_IRQL' : [ 0x20, { 'Thread' : [ 0x0, ['pointer', ['void']]], @@ -3590,11 +3590,11 @@ nt_types = { } ], '_CM_KEY_CONTROL_BLOCK' : [ 0x90, { 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x8, ['unsigned long']], 'NextHash' : [ 0xc, ['pointer', ['_CM_KEY_HASH']]], @@ -3615,10 +3615,10 @@ nt_types = { 'KcbMaxNameLen' : [ 0x58, ['unsigned short']], 'KcbMaxValueNameLen' : [ 0x5a, ['unsigned short']], 'KcbMaxValueDataLen' : [ 0x5c, ['unsigned long']], - 'KcbUserFlags' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'KcbVirtControlFlags' : [ 0x60, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'KcbDebug' : [ 0x60, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Flags' : [ 0x60, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'KcbUserFlags' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0x60, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0x60, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0x60, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'KCBUoWListHead' : [ 0x64, ['_LIST_ENTRY']], 'TransKCBOwner' : [ 0x6c, ['pointer', ['_CM_TRANS']]], 'KCBLock' : [ 0x70, ['_CM_INTENT_LOCK']], @@ -3628,12 +3628,12 @@ nt_types = { 'FullKCBName' : [ 0x8c, ['pointer', ['_UNICODE_STRING']]], } ], '_MMPTE_SOFTWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_CACHE_UNINITIALIZE_EVENT' : [ 0x14, { 'Next' : [ 0x0, ['pointer', ['_CACHE_UNINITIALIZE_EVENT']]], @@ -3659,9 +3659,9 @@ nt_types = { } ], '_MM_SUBSECTION_AVL_TABLE' : [ 0x20, { 'BalancedRoot' : [ 0x0, ['_MMSUBSECTION_NODE']], - 'DepthOfTree' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x18, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DepthOfTree' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x18, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'NodeHint' : [ 0x1c, ['pointer', ['void']]], } ], '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { @@ -3687,17 +3687,17 @@ nt_types = { 'DataValueHigh' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], - 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEGMENT_OBJECT' : [ 0x28, { 'BaseAddress' : [ 0x0, ['pointer', ['void']]], @@ -3790,28 +3790,28 @@ nt_types = { 'DataLength' : [ 0x8, ['unsigned long']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SessionMaster' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'TrimmerAttached' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'TrimmerDetaching' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Available' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SessionMaster' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'TrimmerAttached' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'TrimmerDetaching' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Available' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], } ], '__unnamed_19f1' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'UsingHypervisor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'UsingHypervisor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], } ], 'PPM_PERF_STATES' : [ 0x68, { 'Count' : [ 0x0, ['unsigned long']], @@ -4103,25 +4103,25 @@ nt_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -4224,12 +4224,12 @@ nt_types = { 'Info' : [ 0x84, ['_THERMAL_INFORMATION_EX']], } ], '_MMPTE_LIST' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_VI_POOL_PAGE_HEADER' : [ 0xc, { 'NextPage' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], @@ -4347,10 +4347,10 @@ nt_types = { } ], '__unnamed_1b06' : [ 0x1, { 'AsUCHAR' : [ 0x0, ['unsigned char']], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], } ], 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { 'Revision' : [ 0x0, ['unsigned long']], @@ -4382,12 +4382,12 @@ nt_types = { 'Busy' : [ 0x10, ['unsigned char']], } ], '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], 'ContextAsUlong' : [ 0x0, ['unsigned long']], } ], '_IO_CLIENT_EXTENSION' : [ 0x8, { @@ -4407,13 +4407,13 @@ nt_types = { 'ActualLimit' : [ 0x10, ['unsigned long']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], } ], '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { 'Present' : [ 0x0, ['unsigned long long']], @@ -4440,14 +4440,14 @@ nt_types = { 'Reserved' : [ 0xc, ['unsigned long']], } ], '_MMWSLENTRY' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_DBGKD_SWITCH_PARTITION' : [ 0x4, { 'Partition' : [ 0x0, ['unsigned long']], @@ -4560,10 +4560,10 @@ nt_types = { 'StartPerfClock' : [ 0x8, ['_LARGE_INTEGER']], } ], '_MMPTE_SUBSECTION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_POWER_STATE' : [ 0x4, { 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], @@ -4700,12 +4700,12 @@ nt_types = { 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], 'SafeBootMode' : [ 0x2ec, ['unsigned char']], 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], - 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 32)]], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], 'SystemCall' : [ 0x300, ['unsigned long']], 'SystemCallReturn' : [ 0x304, ['unsigned long']], @@ -4742,7 +4742,7 @@ nt_types = { 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], } ], '__unnamed_1ba4' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMSUBSECTION_NODE']]], } ], '_MMSUBSECTION_NODE' : [ 0x18, { @@ -4773,16 +4773,16 @@ nt_types = { 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], } ], '_WHEA_ERROR_STATUS' : [ 0x8, { - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], } ], '_FS_FILTER_CALLBACKS' : [ 0x38, { 'SizeOfFsFilterCallbacks' : [ 0x0, ['unsigned long']], @@ -4998,12 +4998,12 @@ nt_types = { '_OBJECT_TYPE_INITIALIZER' : [ 0x4c, { 'Length' : [ 0x0, ['unsigned short']], 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], - 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6)]], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], 'ObjectTypeCode' : [ 0x4, ['unsigned long']], 'InvalidAttributes' : [ 0x8, ['unsigned long']], 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], @@ -5181,10 +5181,10 @@ nt_types = { '_IMAGE_SECURITY_CONTEXT' : [ 0x4, { 'PageHashes' : [ 0x0, ['pointer', ['void']]], 'Value' : [ 0x0, ['unsigned long']], - 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1c7e' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], @@ -5260,8 +5260,8 @@ nt_types = { 'FirmwareDescriptorListHead' : [ 0x48, ['_LIST_ENTRY']], 'AcpiTable' : [ 0x50, ['pointer', ['void']]], 'AcpiTableSize' : [ 0x54, ['unsigned long']], - 'BootViaWinload' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'BootViaWinload' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'LoaderPerformanceData' : [ 0x5c, ['pointer', ['_LOADER_PERFORMANCE_DATA']]], 'BootApplicationPersistentData' : [ 0x60, ['_LIST_ENTRY']], 'WmdTestResult' : [ 0x68, ['pointer', ['void']]], @@ -5402,10 +5402,10 @@ nt_types = { 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], } ], '_POOL_HEADER' : [ 0x8, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16)]], - 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'AllocatorBackTraceIndex' : [ 0x4, ['unsigned short']], @@ -5482,8 +5482,8 @@ nt_types = { } ], '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x8, { 'Process' : [ 0x0, ['pointer', ['_EPROCESS']]], - 'HandleCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'LockCount' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'HandleCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_CLIENT_ID' : [ 0x8, { 'UniqueProcess' : [ 0x0, ['pointer', ['void']]], @@ -5497,8 +5497,8 @@ nt_types = { } ], '_VI_DEADLOCK_RESOURCE' : [ 0x80, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer', ['void']]], 'ThreadOwner' : [ 0xc, ['pointer', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x10, ['_LIST_ENTRY']], @@ -5516,33 +5516,33 @@ nt_types = { 'Length' : [ 0x10, ['unsigned long']], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], } ], '_SECURITY_CLIENT_CONTEXT' : [ 0x3c, { 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], @@ -5719,9 +5719,9 @@ nt_types = { } ], '__unnamed_1d96' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { 'Revision' : [ 0x0, ['unsigned short']], @@ -5869,10 +5869,10 @@ nt_types = { 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], 'Security' : [ 0x2c, ['unsigned long']], 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'MaxClassLen' : [ 0x38, ['unsigned long']], 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], 'MaxValueDataLen' : [ 0x40, ['unsigned long']], @@ -5927,16 +5927,16 @@ nt_types = { 'DebuggerDataList' : [ 0x20, ['unsigned long long']], } ], '_WHEA_PCIX_BUS_VALIDATION_BITS' : [ 0x8, { - 'ErrorStatusValid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ErrorTypeValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BusIdValid' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'BusAddressValid' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'BusDataValid' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'CommandValid' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RequestorIdValid' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'CompleterIdValid' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'TargetIdValid' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 64)]], + 'ErrorStatusValid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'ErrorTypeValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'BusIdValid' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'BusAddressValid' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'BusDataValid' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'CommandValid' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'RequestorIdValid' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'CompleterIdValid' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'TargetIdValid' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 64, native_type='unsigned long long')]], } ], '_HMAP_ENTRY' : [ 0x10, { 'BlockAddress' : [ 0x0, ['unsigned long']], @@ -6066,17 +6066,17 @@ nt_types = { 'TimeRefreshLockAcquired' : [ 0x184, ['unsigned char']], } ], '_SEGMENT_FLAGS' : [ 0x4, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22)]], - 'ContainsPxeSubsection' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 32)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22, native_type='unsigned long')]], + 'ContainsPxeSubsection' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 32, native_type='unsigned long')]], } ], '_EX_WORK_QUEUE' : [ 0x3c, { 'WorkerQueue' : [ 0x0, ['_KQUEUE']], @@ -6287,9 +6287,9 @@ nt_types = { '_VF_BTS_RECORD' : [ 0xc, { 'JumpedFrom' : [ 0x0, ['pointer', ['void']]], 'JumpedTo' : [ 0x4, ['pointer', ['void']]], - 'Unused1' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Predicted' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 7)]], - 'Unused2' : [ 0x8, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Unused1' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Predicted' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'Unused2' : [ 0x8, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_KTRANSACTION' : [ 0x1a8, { 'OutcomeEvent' : [ 0x0, ['_KEVENT']], @@ -6330,11 +6330,11 @@ nt_types = { 'TransactionHistoryCount' : [ 0x1a0, ['unsigned long']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], } ], '_CM_KCB_UOW' : [ 0x38, { 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -6363,19 +6363,19 @@ nt_types = { 'SpecialRegisters' : [ 0x2cc, ['_KSPECIAL_REGISTERS']], } ], '_MMPTE_TRANSITION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_CM_KEY_SECURITY_CACHE' : [ 0x2c, { 'Cell' : [ 0x0, ['unsigned long']], @@ -6392,19 +6392,19 @@ nt_types = { 'Name' : [ 0xa, ['array', 1, ['wchar']]], } ], '_MMSECURE_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12, native_type='unsigned long')]], } ], '_PO_IRP_QUEUE' : [ 0x8, { 'CurrentIrp' : [ 0x0, ['pointer', ['_IRP']]], 'PendingIrpList' : [ 0x4, ['pointer', ['_IRP']]], } ], '__unnamed_1e7a' : [ 0x4, { - 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'Whole' : [ 0x0, ['unsigned long']], } ], '_VI_DEADLOCK_NODE' : [ 0x68, { @@ -6490,11 +6490,11 @@ nt_types = { 'Reserved' : [ 0x2c, ['array', 3, ['unsigned long']]], } ], '_WHEA_PERSISTENCE_INFO' : [ 0x8, { - 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 46)]], - 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 46, end_bit = 48)]], - 'Signature' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 46, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 46, end_bit = 48, native_type='unsigned long long')]], + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '_MI_SECTION_IMAGE_INFORMATION' : [ 0x34, { 'ExportedImageInformation' : [ 0x0, ['_SECTION_IMAGE_INFORMATION']], @@ -6503,15 +6503,15 @@ nt_types = { '_PCIE_DEVICE_ID' : [ 0x10, { 'VendorID' : [ 0x0, ['unsigned short']], 'DeviceID' : [ 0x2, ['unsigned short']], - 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Segment' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 24)]], - 'PrimaryBusNumber' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'SecondaryBusNumber' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 10)]], - 'SlotNumber' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 24)]], - 'Reserved2' : [ 0xc, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Segment' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 24, native_type='unsigned long')]], + 'PrimaryBusNumber' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'SecondaryBusNumber' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 10, native_type='unsigned long')]], + 'SlotNumber' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 24, native_type='unsigned long')]], + 'Reserved2' : [ 0xc, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_HEAP_USERDATA_HEADER' : [ 0x10, { 'SFreeListEntry' : [ 0x0, ['_SINGLE_LIST_ENTRY']], @@ -6531,12 +6531,12 @@ nt_types = { 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], } ], '_WHEA_PCIX_DEV_VALIDATION_BITS' : [ 0x8, { - 'ErrorStatusValid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IdInfoValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryNumberValid' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IoNumberValid' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RegisterDataPairValid' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 64)]], + 'ErrorStatusValid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'IdInfoValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'MemoryNumberValid' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'IoNumberValid' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'RegisterDataPairValid' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 64, native_type='unsigned long long')]], } ], '_DEFERRED_WRITE' : [ 0x28, { 'NodeTypeCode' : [ 0x0, ['short']], @@ -6577,10 +6577,10 @@ nt_types = { 'Machine' : [ 0x20, ['unsigned short']], 'ImageContainsCode' : [ 0x22, ['unsigned char']], 'ImageFlags' : [ 0x23, ['unsigned char']], - 'ComPlusNativeReady' : [ 0x23, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ComPlusILOnly' : [ 0x23, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ImageDynamicallyRelocated' : [ 0x23, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x23, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'ComPlusNativeReady' : [ 0x23, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x23, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x23, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x23, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], 'LoaderFlags' : [ 0x24, ['unsigned long']], 'ImageFileSize' : [ 0x28, ['unsigned long']], 'CheckSum' : [ 0x2c, ['unsigned long']], @@ -6779,10 +6779,10 @@ nt_types = { 'TotalPhysicalMemoryCount' : [ 0xdc, ['unsigned long']], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'BATTERY_REPORTING_SCALE' : [ 0x8, { @@ -6812,13 +6812,13 @@ nt_types = { 'HiberFileResumeTime' : [ 0x58, ['unsigned long long']], } ], '_DEVICE_FLAGS' : [ 0x4, { - 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], } ], '_RTL_BALANCED_LINKS' : [ 0x10, { 'Parent' : [ 0x0, ['pointer', ['_RTL_BALANCED_LINKS']]], @@ -6829,18 +6829,18 @@ nt_types = { } ], '_MMVIEW' : [ 0x8, { 'Entry' : [ 0x0, ['unsigned long']], - 'Writable' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Writable' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], 'ControlArea' : [ 0x4, ['pointer', ['_CONTROL_AREA']]], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x20, { 'Type' : [ 0x0, ['unsigned short']], diff --git a/volatility/plugins/overlays/windows/vista_sp1_x64_vtypes.py b/volatility/plugins/overlays/windows/vista_sp1_x64_vtypes.py index 6dbf0b64..ee2a8e6d 100644 --- a/volatility/plugins/overlays/windows/vista_sp1_x64_vtypes.py +++ b/volatility/plugins/overlays/windows/vista_sp1_x64_vtypes.py @@ -65,11 +65,11 @@ ntkrnlmp_types = { 'PromotionCompletedEvent' : [ 0x2c0, ['_KEVENT']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], } ], '_CM_KCB_UOW' : [ 0x60, { 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -94,29 +94,29 @@ ntkrnlmp_types = { 'ThisVolatileKeyCell' : [ 0x58, ['unsigned long']], } ], '_MMPTE_TRANSITION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '_KREQUEST_PACKET' : [ 0x20, { 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer64', ['void']]]], 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '__unnamed_202d' : [ 0x8, { - 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48)]], - 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_202f' : [ 0x8, { 's1' : [ 0x0, ['__unnamed_202d']], @@ -140,19 +140,19 @@ ntkrnlmp_types = { 'Name' : [ 0x12, ['array', 1, ['wchar']]], } ], '_MMSECURE_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12, native_type='unsigned long')]], } ], '_PO_IRP_QUEUE' : [ 0x10, { 'CurrentIrp' : [ 0x0, ['pointer64', ['_IRP']]], 'PendingIrpList' : [ 0x8, ['pointer64', ['_IRP']]], } ], '__unnamed_2041' : [ 0x4, { - 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'Whole' : [ 0x0, ['unsigned long']], } ], '_VI_DEADLOCK_NODE' : [ 0xd0, { @@ -243,12 +243,12 @@ ntkrnlmp_types = { 'Reserved' : [ 0x30, ['array', 3, ['unsigned long']]], } ], '_WHEA_PERSISTENCE_INFO' : [ 0x8, { - 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40)]], - 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56)]], - 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58)]], - 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64)]], + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], 'AsULONGLONG' : [ 0x0, ['unsigned long long']], } ], '_MI_SECTION_IMAGE_INFORMATION' : [ 0x50, { @@ -327,11 +327,11 @@ ntkrnlmp_types = { 'Machine' : [ 0x30, ['unsigned short']], 'ImageContainsCode' : [ 0x32, ['unsigned char']], 'ImageFlags' : [ 0x33, ['unsigned char']], - 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'LoaderFlags' : [ 0x34, ['unsigned long']], 'ImageFileSize' : [ 0x38, ['unsigned long']], 'CheckSum' : [ 0x3c, ['unsigned long']], @@ -490,20 +490,20 @@ ntkrnlmp_types = { 'Dacl' : [ 0x10, ['unsigned long']], } ], '_WHEA_GENERIC_PROCESSOR_ERROR_VALIDBITS' : [ 0x8, { - 'ProcessorType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InstructionSet' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Operation' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Flags' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Level' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CPUVersion' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'CPUBrandString' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ProcessorId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'TargetAddress' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'InstructionPointer' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 64)]], + 'ProcessorType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'InstructionSet' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Operation' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Flags' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Level' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'CPUVersion' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'CPUBrandString' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'ProcessorId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'TargetAddress' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'InstructionPointer' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '__unnamed_20ce' : [ 0x20, { @@ -572,10 +572,10 @@ ntkrnlmp_types = { 'ResumeContextPages' : [ 0x138, ['unsigned long']], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'BATTERY_REPORTING_SCALE' : [ 0x8, { @@ -605,13 +605,13 @@ ntkrnlmp_types = { 'HiberFileResumeTime' : [ 0x58, ['unsigned long long']], } ], '_DEVICE_FLAGS' : [ 0x4, { - 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], } ], '_RTL_BALANCED_LINKS' : [ 0x20, { 'Parent' : [ 0x0, ['pointer64', ['_RTL_BALANCED_LINKS']]], @@ -622,18 +622,18 @@ ntkrnlmp_types = { } ], '_MMVIEW' : [ 0x10, { 'Entry' : [ 0x0, ['unsigned long long']], - 'Writable' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Writable' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], 'ControlArea' : [ 0x8, ['pointer64', ['_CONTROL_AREA']]], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x30, { 'Type' : [ 0x0, ['unsigned short']], @@ -849,11 +849,11 @@ ntkrnlmp_types = { '_KIDTENTRY64' : [ 0x10, { 'OffsetLow' : [ 0x0, ['unsigned short']], 'Selector' : [ 0x2, ['unsigned short']], - 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned short')]], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned short')]], + 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned short')]], + 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], 'OffsetMiddle' : [ 0x6, ['unsigned short']], 'OffsetHigh' : [ 0x8, ['unsigned long']], 'Reserved1' : [ 0xc, ['unsigned long']], @@ -884,16 +884,16 @@ ntkrnlmp_types = { 'BaseHigh' : [ 0x3, ['unsigned char']], } ], '__unnamed_2154' : [ 0x4, { - 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_KGDTENTRY64' : [ 0x10, { 'LimitLow' : [ 0x0, ['unsigned short']], @@ -954,8 +954,8 @@ ntkrnlmp_types = { 'QuadPart' : [ 0x0, ['long long']], } ], '__unnamed_103d' : [ 0x4, { - 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Private' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_103f' : [ 0x4, { 'Flags' : [ 0x0, ['unsigned long']], @@ -1217,15 +1217,15 @@ ntkrnlmp_types = { 'WaitStatus' : [ 0x80, ['long long']], 'WaitBlockList' : [ 0x88, ['pointer64', ['_KWAIT_BLOCK']]], 'GateObject' : [ 0x88, ['pointer64', ['_KGATE']]], - 'KernelStackResident' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadyTransition' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessReadyQueue' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WaitNext' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemAffinityActive' : [ 0x90, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Alertable' : [ 0x90, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'GdiFlushActive' : [ 0x90, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'UserStackWalkActive' : [ 0x90, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Reserved' : [ 0x90, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'KernelStackResident' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessReadyQueue' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WaitNext' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x90, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Alertable' : [ 0x90, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GdiFlushActive' : [ 0x90, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x90, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x90, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x90, ['long']], 'WaitReason' : [ 0x94, ['unsigned char']], 'SwapBusy' : [ 0x95, ['unsigned char']], @@ -1236,16 +1236,16 @@ ntkrnlmp_types = { 'Teb' : [ 0xb0, ['pointer64', ['void']]], 'Timer' : [ 0xb8, ['_KTIMER']], 'TimerFill' : [ 0xb8, ['array', 60, ['unsigned char']]], - 'AutoAlignment' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwStackTraceApc1Inserted' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EtwStackTraceApc2Inserted' : [ 0xf4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CycleChargePending' : [ 0xf4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'CalloutActive' : [ 0xf4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ApcQueueable' : [ 0xf4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'EnableStackSwap' : [ 0xf4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'GuiThread' : [ 0xf4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'ReservedFlags' : [ 0xf4, ['BitField', dict(start_bit = 9, end_bit = 32)]], + 'AutoAlignment' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'EtwStackTraceApc1Inserted' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EtwStackTraceApc2Inserted' : [ 0xf4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CycleChargePending' : [ 0xf4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CalloutActive' : [ 0xf4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ApcQueueable' : [ 0xf4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0xf4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'GuiThread' : [ 0xf4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xf4, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], 'ThreadFlags' : [ 0xf4, ['long']], 'WaitBlock' : [ 0xf8, ['array', 4, ['_KWAIT_BLOCK']]], 'WaitBlockFill0' : [ 0xf8, ['array', 43, ['unsigned char']]], @@ -1338,21 +1338,21 @@ ntkrnlmp_types = { 'OldIrql' : [ 0x30, ['unsigned long']], } ], '__unnamed_1119' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 25)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 64)]], - 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 61)]], - 'Region' : [ 0x8, ['BitField', dict(start_bit = 61, end_bit = 64)]], + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 25, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 61, native_type='unsigned long long')]], + 'Region' : [ 0x8, ['BitField', dict(start_bit = 61, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_111e' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], - 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], } ], '_SLIST_HEADER' : [ 0x10, { 'Alignment' : [ 0x0, ['unsigned long long']], @@ -1382,11 +1382,11 @@ ntkrnlmp_types = { 'Information' : [ 0x8, ['unsigned long long']], } ], '_EX_PUSH_LOCK' : [ 0x8, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], 'Ptr' : [ 0x0, ['pointer64', ['void']]], } ], @@ -1419,7 +1419,7 @@ ntkrnlmp_types = { } ], '_EX_FAST_REF' : [ 0x8, { 'Object' : [ 0x0, ['pointer64', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], } ], '_EX_PUSH_LOCK_WAIT_BLOCK' : [ 0x40, { @@ -1463,45 +1463,45 @@ ntkrnlmp_types = { 'ReadClusterSize' : [ 0x410, ['unsigned long']], 'MmLockOrdering' : [ 0x414, ['long']], 'CrossThreadFlags' : [ 0x418, ['unsigned long']], - 'Terminated' : [ 0x418, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ThreadInserted' : [ 0x418, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x418, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x418, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x418, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x418, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x418, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x418, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x418, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyTokenOnOpen' : [ 0x418, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ThreadIoPriority' : [ 0x418, ['BitField', dict(start_bit = 10, end_bit = 13)]], - 'ThreadPagePriority' : [ 0x418, ['BitField', dict(start_bit = 13, end_bit = 16)]], - 'RundownFail' : [ 0x418, ['BitField', dict(start_bit = 16, end_bit = 17)]], + 'Terminated' : [ 0x418, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x418, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x418, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x418, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x418, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x418, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x418, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x418, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x418, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x418, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x418, ['BitField', dict(start_bit = 10, end_bit = 13, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x418, ['BitField', dict(start_bit = 13, end_bit = 16, native_type='unsigned long')]], + 'RundownFail' : [ 0x418, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x41c, ['unsigned long']], - 'ActiveExWorker' : [ 0x41c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x41c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x41c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ClonedThread' : [ 0x41c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'KeyedEventInUse' : [ 0x41c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RateApcState' : [ 0x41c, ['BitField', dict(start_bit = 5, end_bit = 7)]], - 'SelfTerminate' : [ 0x41c, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveExWorker' : [ 0x41c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x41c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x41c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x41c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x41c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RateApcState' : [ 0x41c, ['BitField', dict(start_bit = 5, end_bit = 7, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x41c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x420, ['unsigned long']], - 'Spare' : [ 0x420, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'StartAddressInvalid' : [ 0x420, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwPageFaultCalloutActive' : [ 0x420, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x420, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemWorkingSetShared' : [ 0x420, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x421, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsProcessAddressSpaceExclusive' : [ 0x421, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsProcessAddressSpaceShared' : [ 0x421, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SuppressSymbolLoad' : [ 0x421, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Prefetching' : [ 0x421, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsDynamicMemoryShared' : [ 0x421, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsChangeControlAreaExclusive' : [ 0x421, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsChangeControlAreaShared' : [ 0x421, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Spare1' : [ 0x422, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Spare' : [ 0x420, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x420, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EtwPageFaultCalloutActive' : [ 0x420, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x420, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemWorkingSetShared' : [ 0x420, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x421, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceExclusive' : [ 0x421, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x421, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x421, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Prefetching' : [ 0x421, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsDynamicMemoryShared' : [ 0x421, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsChangeControlAreaExclusive' : [ 0x421, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsChangeControlAreaShared' : [ 0x421, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare1' : [ 0x422, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], 'PriorityRegionActive' : [ 0x423, ['unsigned char']], 'CacheManagerActive' : [ 0x424, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x425, ['unsigned char']], @@ -1529,7 +1529,7 @@ ntkrnlmp_types = { 'DebugPort' : [ 0x150, ['pointer64', ['void']]], 'ExceptionPortData' : [ 0x158, ['pointer64', ['void']]], 'ExceptionPortValue' : [ 0x158, ['unsigned long long']], - 'ExceptionPortState' : [ 0x158, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'ExceptionPortState' : [ 0x158, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], 'ObjectTable' : [ 0x160, ['pointer64', ['_HANDLE_TABLE']]], 'Token' : [ 0x168, ['_EX_FAST_REF']], 'WorkingSetPage' : [ 0x170, ['unsigned long long']], @@ -1584,55 +1584,55 @@ ntkrnlmp_types = { 'MmProcessLinks' : [ 0x358, ['_LIST_ENTRY']], 'ModifiedPageCount' : [ 0x368, ['unsigned long']], 'Flags2' : [ 0x36c, ['unsigned long']], - 'JobNotReallyActive' : [ 0x36c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AccountingFolded' : [ 0x36c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'NewProcessReported' : [ 0x36c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ExitProcessReported' : [ 0x36c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReportCommitChanges' : [ 0x36c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LastReportMemory' : [ 0x36c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ReportPhysicalPageChanges' : [ 0x36c, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'HandleTableRundown' : [ 0x36c, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'NeedsHandleRundown' : [ 0x36c, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RefTraceEnabled' : [ 0x36c, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'NumaAware' : [ 0x36c, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtectedProcess' : [ 0x36c, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'DefaultPagePriority' : [ 0x36c, ['BitField', dict(start_bit = 12, end_bit = 15)]], - 'PrimaryTokenFrozen' : [ 0x36c, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessVerifierTarget' : [ 0x36c, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'StackRandomizationDisabled' : [ 0x36c, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'AffinityPermanent' : [ 0x36c, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'AffinityUpdateEnable' : [ 0x36c, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'CrossSessionCreate' : [ 0x36c, ['BitField', dict(start_bit = 20, end_bit = 21)]], + 'JobNotReallyActive' : [ 0x36c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x36c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x36c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x36c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x36c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x36c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ReportPhysicalPageChanges' : [ 0x36c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'HandleTableRundown' : [ 0x36c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x36c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x36c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'NumaAware' : [ 0x36c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtectedProcess' : [ 0x36c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x36c, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x36c, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x36c, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x36c, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x36c, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x36c, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x36c, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], 'Flags' : [ 0x370, ['unsigned long']], - 'CreateReported' : [ 0x370, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x370, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x370, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x370, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x370, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x370, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x370, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x370, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x370, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x370, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x370, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x370, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x370, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'DeprioritizeViews' : [ 0x370, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x370, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x370, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x370, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x370, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x370, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x370, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x370, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x370, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x370, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x370, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'SmapAllowed' : [ 0x370, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'ProcessInserted' : [ 0x370, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x370, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'ProcessSelfDelete' : [ 0x370, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'SpareProcessFlags' : [ 0x370, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x370, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x370, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x370, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x370, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x370, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x370, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x370, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x370, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x370, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x370, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x370, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x370, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x370, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x370, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x370, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x370, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x370, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x370, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x370, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x370, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x370, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x370, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x370, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x370, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SmapAllowed' : [ 0x370, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x370, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x370, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x370, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SpareProcessFlags' : [ 0x370, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x374, ['long']], 'Spare7' : [ 0x378, ['unsigned short']], 'SubSystemMinorVersion' : [ 0x37a, ['unsigned char']], @@ -2116,10 +2116,10 @@ ntkrnlmp_types = { 'ThreadListHead' : [ 0x70, ['_LIST_ENTRY']], 'ProcessLock' : [ 0x80, ['unsigned long long']], 'Affinity' : [ 0x88, ['unsigned long long']], - 'AutoAlignment' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ReservedFlags' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'AutoAlignment' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ReservedFlags' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='long')]], 'ProcessFlags' : [ 0x90, ['long']], 'BasePriority' : [ 0x94, ['unsigned char']], 'QuantumReset' : [ 0x95, ['unsigned char']], @@ -2210,12 +2210,12 @@ ntkrnlmp_types = { 'e3' : [ 0x0, ['__unnamed_141f']], } ], '__unnamed_1429' : [ 0x8, { - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 52)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55)]], - 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 52, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57, native_type='unsigned long long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58, native_type='unsigned long long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64, native_type='unsigned long long')]], } ], '_MMPFN' : [ 0x30, { 'u1' : [ 0x0, ['__unnamed_1417']], @@ -2315,10 +2315,10 @@ ntkrnlmp_types = { 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], 'WritableUserReferences' : [ 0x4, ['long']], - 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30)]], - 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30, native_type='unsigned long')]], + 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubsectionRoot' : [ 0x8, ['pointer64', ['_MM_SUBSECTION_AVL_TABLE']]], 'SeImageStub' : [ 0x8, ['pointer64', ['_MI_IMAGE_SECURITY_REFERENCE']]], } ], @@ -2354,11 +2354,11 @@ ntkrnlmp_types = { 'Bitmap' : [ 0x58, ['pointer64', ['_RTL_BITMAP']]], 'BitmapHint' : [ 0x60, ['unsigned long']], 'LastAllocationSize' : [ 0x64, ['unsigned long']], - 'PageFileNumber' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'BootPartition' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Spare0' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 16)]], - 'AdriftMdls' : [ 0x6a, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare1' : [ 0x6a, ['BitField', dict(start_bit = 1, end_bit = 16)]], + 'PageFileNumber' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'BootPartition' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Spare0' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x6a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare1' : [ 0x6a, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], 'FileHandle' : [ 0x70, ['pointer64', ['void']]], 'AvailableList' : [ 0x80, ['_SLIST_HEADER']], 'NeedProcessingList' : [ 0x90, ['_SLIST_HEADER']], @@ -2368,7 +2368,7 @@ ntkrnlmp_types = { 'FreeBit' : [ 0x8, ['unsigned long']], } ], '__unnamed_14aa' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMVAD']]], } ], '__unnamed_14ad' : [ 0x8, { @@ -2391,9 +2391,9 @@ ntkrnlmp_types = { } ], '_MM_AVL_TABLE' : [ 0x40, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'NodeHint' : [ 0x30, ['pointer64', ['void']]], 'NodeFreeHint' : [ 0x38, ['pointer64', ['void']]], } ], @@ -2417,7 +2417,7 @@ ntkrnlmp_types = { 'LastContiguousPte' : [ 0x58, ['pointer64', ['_MMPTE']]], } ], '__unnamed_14ca' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x28, { @@ -2443,7 +2443,7 @@ ntkrnlmp_types = { 'NumberOfFullSectors' : [ 0x30, ['unsigned long']], } ], '__unnamed_14d5' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMADDRESS_NODE']]], 'NextToFree' : [ 0x0, ['pointer64', ['_MI_PER_SESSION_PROTOS']]], } ], @@ -2647,19 +2647,19 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0x17e0, ['pointer64', ['void']]], 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'DbgSafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgInDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgHasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgSkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgWerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgRanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DbgSuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RtlDisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 16)]], + 'DbgSafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgInDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgHasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgSkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgWerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgRanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgSuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RtlDisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0x17f0, ['pointer64', ['void']]], 'TxnScopeExitCallback' : [ 0x17f8, ['pointer64', ['void']]], 'TxnScopeContext' : [ 0x1800, ['pointer64', ['void']]], @@ -2719,9 +2719,9 @@ ntkrnlmp_types = { } ], '__unnamed_15c4' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'PStateDomain' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PStateDomainIdleAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'PStateDomain' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'PStateDomainIdleAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], '_PROCESSOR_POWER_STATE' : [ 0x118, { 'IdleStates' : [ 0x0, ['pointer64', ['_PPM_IDLE_STATES']]], @@ -3517,19 +3517,19 @@ ntkrnlmp_types = { 'BufferSequenceNumber' : [ 0x330, ['long long']], 'AcceptNewEvents' : [ 0x338, ['long']], 'Flags' : [ 0x33c, ['unsigned long']], - 'Persistent' : [ 0x33c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoLogger' : [ 0x33c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'FsReady' : [ 0x33c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RealTime' : [ 0x33c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow' : [ 0x33c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelTrace' : [ 0x33c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'NoMoreEnable' : [ 0x33c, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Persistent' : [ 0x33c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x33c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x33c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x33c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x33c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x33c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x33c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], 'RequestFlag' : [ 0x340, ['unsigned long']], - 'RequestNewFie' : [ 0x340, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'RequestUpdateFile' : [ 0x340, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'RequestFlush' : [ 0x340, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RequestDisableRealtime' : [ 0x340, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RequestDisconnectConsumer' : [ 0x340, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'RequestNewFie' : [ 0x340, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RequestUpdateFile' : [ 0x340, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'RequestFlush' : [ 0x340, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RequestDisableRealtime' : [ 0x340, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequestDisconnectConsumer' : [ 0x340, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], 'StackTraceFilterHookCount' : [ 0x344, ['unsigned short']], 'StackTraceFilter' : [ 0x346, ['array', 16, ['unsigned short']]], } ], @@ -3587,8 +3587,8 @@ ntkrnlmp_types = { 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], 'LoggerId' : [ 0x8, ['unsigned short']], 'Level' : [ 0xa, ['unsigned char']], - 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_TRACE_ENABLE_CONTEXT' : [ 0x8, { 'LoggerId' : [ 0x0, ['unsigned short']], @@ -3664,10 +3664,10 @@ ntkrnlmp_types = { 'Object' : [ 0x0, ['pointer64', ['void']]], } ], '__unnamed_1817' : [ 0x1, { - 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], } ], '__unnamed_1819' : [ 0x1, { 's1' : [ 0x0, ['__unnamed_1817']], @@ -3683,8 +3683,8 @@ ntkrnlmp_types = { 'Lock' : [ 0x18, ['_EX_PUSH_LOCK']], } ], '__unnamed_1824' : [ 0x4, { - 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_1826' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1824']], @@ -3701,7 +3701,7 @@ ntkrnlmp_types = { 'RegionListHead' : [ 0x40, ['_LIST_ENTRY']], } ], '__unnamed_1833' : [ 0x4, { - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], } ], '__unnamed_1835' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1833']], @@ -3719,9 +3719,9 @@ ntkrnlmp_types = { 'ViewListHead' : [ 0x50, ['_LIST_ENTRY']], } ], '__unnamed_183b' : [ 0x4, { - 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], } ], '__unnamed_183d' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_183b']], @@ -3747,21 +3747,21 @@ ntkrnlmp_types = { 'HandleTable' : [ 0x28, ['_ALPC_HANDLE_TABLE']], } ], '__unnamed_1855' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], } ], '__unnamed_1857' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1855']], @@ -3810,16 +3810,16 @@ ntkrnlmp_types = { 'CallbackId' : [ 0x14, ['unsigned long']], } ], '__unnamed_1873' : [ 0x4, { - 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], } ], '__unnamed_1875' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1873']], @@ -3870,8 +3870,8 @@ ntkrnlmp_types = { 'HandleData' : [ 0x30, ['pointer64', ['_KALPC_HANDLE_DATA']]], } ], '__unnamed_18b4' : [ 0x4, { - 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_18b6' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_18b4']], @@ -3997,18 +3997,18 @@ ntkrnlmp_types = { '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x8, { 'ImpersonationData' : [ 0x0, ['unsigned long long']], 'ImpersonationToken' : [ 0x0, ['pointer64', ['void']]], - 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], } ], '_MMVAD_FLAGS3' : [ 0x8, { - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6)]], - 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24)]], - 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'LargePageCreating' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33)]], - 'Spare3' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64)]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned long long')]], + 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24, native_type='unsigned long long')]], + 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long long')]], + 'LargePageCreating' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'Spare3' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64, native_type='unsigned long long')]], } ], '_MI_VERIFIER_POOL_HEADER' : [ 0x8, { 'VerifierPoolEntry' : [ 0x0, ['pointer64', ['_VI_POOL_ENTRY']]], @@ -4067,22 +4067,22 @@ ntkrnlmp_types = { 'Request' : [ 0x28, ['_PORT_MESSAGE']], } ], '_HARDWARE_PTE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_DUAL' : [ 0x278, { 'Length' : [ 0x0, ['unsigned long']], @@ -4221,7 +4221,7 @@ ntkrnlmp_types = { 'DebugInfo' : [ 0x38, ['pointer64', ['_HANDLE_TRACE_DEBUG_INFO']]], 'ExtraInfoPages' : [ 0x40, ['long']], 'Flags' : [ 0x44, ['unsigned long']], - 'StrictFIFO' : [ 0x44, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x44, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], 'FirstFreeHandle' : [ 0x48, ['long']], 'LastFreeHandleEntry' : [ 0x50, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], 'HandleCount' : [ 0x58, ['long']], @@ -4234,15 +4234,15 @@ ntkrnlmp_types = { 'NumberOfBytes' : [ 0x10, ['unsigned long long']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_VI_CANCEL_GLOBALS' : [ 0x78, { 'CancelLock' : [ 0x0, ['unsigned long long']], @@ -4296,20 +4296,20 @@ ntkrnlmp_types = { 'Reserved4' : [ 0x1a0, ['array', 96, ['unsigned char']]], } ], '_MMPTE_PROTOTYPE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CpuValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CpuValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_THERMAL_INFORMATION_EX' : [ 0x58, { @@ -4326,15 +4326,15 @@ ntkrnlmp_types = { 'S4TransitionTripPoint' : [ 0x54, ['unsigned long']], } ], '__unnamed_19bc' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], } ], '__unnamed_19be' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], } ], '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { 'File' : [ 0x0, ['__unnamed_19bc']], @@ -4346,14 +4346,14 @@ ntkrnlmp_types = { 'Parameters' : [ 0x10, ['array', 2, ['unsigned long long']]], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16)]], - 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16)]], + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], } ], '_EXCEPTION_POINTERS' : [ 0x10, { 'ExceptionRecord' : [ 0x0, ['pointer64', ['_EXCEPTION_RECORD']]], @@ -4467,9 +4467,9 @@ ntkrnlmp_types = { 'u4' : [ 0x70, ['__unnamed_19f3']], } ], '_MMWSLE_FREE_ENTRY' : [ 0x8, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], - 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_NT_TIB' : [ 0x38, { 'ExceptionList' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], @@ -4527,11 +4527,11 @@ ntkrnlmp_types = { } ], '__unnamed_1a06' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Hypervisor' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Hypervisor' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_IDLE_STATES' : [ 0x48, { 'Type' : [ 0x0, ['unsigned long']], @@ -4548,12 +4548,12 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['pointer64', ['void']]], 'ImageBaseAddress' : [ 0x10, ['pointer64', ['void']]], 'Ldr' : [ 0x18, ['pointer64', ['_PEB_LDR_DATA']]], @@ -4564,11 +4564,11 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x40, ['pointer64', ['void']]], 'IFEOKey' : [ 0x48, ['pointer64', ['void']]], 'CrossProcessFlags' : [ 0x50, ['unsigned long']], - 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x58, ['pointer64', ['void']]], 'UserSharedInfoPtr' : [ 0x58, ['pointer64', ['void']]], 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], @@ -4634,8 +4634,8 @@ ntkrnlmp_types = { 'PcatInformation' : [ 0x0, ['_PCAT_FIRMWARE_INFORMATION']], } ], '_FIRMWARE_INFORMATION_LOADER_BLOCK' : [ 0x20, { - 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'u' : [ 0x8, ['__unnamed_1a1f']], } ], '_HEAP_UCR_DESCRIPTOR' : [ 0x30, { @@ -4691,9 +4691,9 @@ ntkrnlmp_types = { 'PostList' : [ 0x10, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x20, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x28, ['pointer64', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x38, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_KINTERRUPT' : [ 0xa0, { @@ -4839,22 +4839,22 @@ ntkrnlmp_types = { 'Lock' : [ 0x18, ['_EX_PUSH_LOCK']], } ], '_MMPTE_HARDWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x10, { 'Port' : [ 0x0, ['pointer64', ['void']]], @@ -4980,13 +4980,13 @@ ntkrnlmp_types = { 'RmLock' : [ 0x80, ['pointer64', ['_ERESOURCE']]], } ], '_MMVAD_FLAGS' : [ 0x8, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51, native_type='unsigned long long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63, native_type='unsigned long long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_WHEA_PCIXDEVICE_ERROR' : [ 0x68, { 'ValidBits' : [ 0x0, ['_WHEA_PCIXDEVICE_ERROR_VALIDBITS']], @@ -5051,10 +5051,10 @@ ntkrnlmp_types = { } ], '_VF_TRACKER_STAMP' : [ 0x10, { 'Thread' : [ 0x0, ['pointer64', ['void']]], - 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], } ], '_VI_TRACK_IRQL' : [ 0x38, { 'Thread' : [ 0x0, ['pointer64', ['void']]], @@ -5094,11 +5094,11 @@ ntkrnlmp_types = { } ], '_CM_KEY_CONTROL_BLOCK' : [ 0x100, { 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 22)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 22, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x8, ['unsigned long']], 'NextHash' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], @@ -5119,10 +5119,10 @@ ntkrnlmp_types = { 'KcbMaxNameLen' : [ 0x98, ['unsigned short']], 'KcbMaxValueNameLen' : [ 0x9a, ['unsigned short']], 'KcbMaxValueDataLen' : [ 0x9c, ['unsigned long']], - 'KcbUserFlags' : [ 0xa0, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'KcbVirtControlFlags' : [ 0xa0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'KcbDebug' : [ 0xa0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Flags' : [ 0xa0, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'KcbUserFlags' : [ 0xa0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0xa0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0xa0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0xa0, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'RealKeyName' : [ 0xa8, ['pointer64', ['unsigned char']]], 'KCBUoWListHead' : [ 0xb0, ['_LIST_ENTRY']], 'TransKCBOwner' : [ 0xc0, ['pointer64', ['_CM_TRANS']]], @@ -5133,14 +5133,14 @@ ntkrnlmp_types = { 'FullKCBName' : [ 0xf8, ['pointer64', ['_UNICODE_STRING']]], } ], '_MMPTE_SOFTWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_CACHE_UNINITIALIZE_EVENT' : [ 0x20, { 'Next' : [ 0x0, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], @@ -5166,9 +5166,9 @@ ntkrnlmp_types = { } ], '_MM_SUBSECTION_AVL_TABLE' : [ 0x38, { 'BalancedRoot' : [ 0x0, ['_MMSUBSECTION_NODE']], - 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'NodeHint' : [ 0x30, ['pointer64', ['void']]], } ], '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { @@ -5199,17 +5199,17 @@ ntkrnlmp_types = { 'DataValueHigh' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], - 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEGMENT_OBJECT' : [ 0x40, { 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], @@ -5259,22 +5259,22 @@ ntkrnlmp_types = { 'DataLength' : [ 0x10, ['unsigned long']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SessionMaster' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'TrimmerAttached' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'TrimmerDetaching' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 4)]], - 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SessionMaster' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'TrimmerAttached' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'TrimmerDetaching' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], } ], 'PPM_IDLE_ACCOUNTING' : [ 0x48, { 'StateCount' : [ 0x0, ['unsigned long']], @@ -5451,19 +5451,19 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'DbgSafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgInDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgHasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgSkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgWerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgRanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DbgSuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RtlDisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 16)]], + 'DbgSafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgInDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgHasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgSkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgWerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgRanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgSuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RtlDisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], @@ -5552,16 +5552,16 @@ ntkrnlmp_types = { 'List' : [ 0x10, ['_LIST_ENTRY']], } ], '_WHEA_PCIXBUS_ERROR_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BusId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'BusAddress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'BusData' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'BusCommand' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'CompleterId' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'BusId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'BusAddress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'BusData' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'BusCommand' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'CompleterId' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '__unnamed_1b88' : [ 0x8, { @@ -5650,25 +5650,25 @@ ntkrnlmp_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -5780,14 +5780,14 @@ ntkrnlmp_types = { 'Info' : [ 0xd0, ['_THERMAL_INFORMATION_EX']], } ], '_MMPTE_LIST' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_VI_POOL_PAGE_HEADER' : [ 0x18, { 'NextPage' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], @@ -5813,9 +5813,9 @@ ntkrnlmp_types = { 'ByteOffset' : [ 0x2c, ['unsigned long']], } ], '_WHEA_PCIXBUS_COMMAND' : [ 0x8, { - 'Command' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 56)]], - 'PCIXCommand' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 64)]], + 'Command' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 56, native_type='unsigned long long')]], + 'PCIXCommand' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 64, native_type='unsigned long long')]], 'AsULONGLONG' : [ 0x0, ['unsigned long long']], } ], '_CM_TRANS' : [ 0xb0, { @@ -5833,10 +5833,10 @@ ntkrnlmp_types = { 'HiveArray' : [ 0x70, ['array', 8, ['pointer64', ['_CMHIVE']]]], } ], '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { - 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x1c, { @@ -5877,13 +5877,13 @@ ntkrnlmp_types = { 'PolicySetStatus' : [ 0x1b, ['unsigned char']], } ], '_MMPTE_TIMESTAMP' : [ 0x8, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], - 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_SID_AND_ATTRIBUTES_HASH' : [ 0x110, { 'SidCount' : [ 0x0, ['unsigned long']], @@ -5904,10 +5904,10 @@ ntkrnlmp_types = { } ], '__unnamed_1c4b' : [ 0x1, { 'AsUCHAR' : [ 0x0, ['unsigned char']], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], } ], 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { 'Revision' : [ 0x0, ['unsigned long']], @@ -5937,29 +5937,29 @@ ntkrnlmp_types = { 'DeviceListHead' : [ 0x8, ['_LIST_ENTRY']], 'Lock' : [ 0x18, ['unsigned long long']], 'Busy' : [ 0x20, ['unsigned char']], - 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='long long')]], + 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='long long')]], } ], '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'ContextAsUlong' : [ 0x0, ['unsigned long']], } ], '_OBJECT_TYPE_INITIALIZER' : [ 0x70, { 'Length' : [ 0x0, ['unsigned short']], 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], - 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], 'ObjectTypeCode' : [ 0x4, ['unsigned long']], 'InvalidAttributes' : [ 0x8, ['unsigned long']], 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], @@ -6009,14 +6009,14 @@ ntkrnlmp_types = { 'ActualLimit' : [ 0x20, ['unsigned long long']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { 'Present' : [ 0x0, ['unsigned long long']], @@ -6024,12 +6024,12 @@ ntkrnlmp_types = { 'EnabledByDefault' : [ 0x10, ['unsigned long long']], } ], '_WHEA_PCIXDEVICE_ERROR_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IdInfo' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryNumber' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IoNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RegisterDataPairs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'IdInfo' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'MemoryNumber' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'IoNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'RegisterDataPairs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], 'WHEA_PCIXDEVICE_REGISTER_PAIR' : [ 0x10, { @@ -6056,14 +6056,14 @@ ntkrnlmp_types = { 'Reserved' : [ 0x14, ['unsigned long']], } ], '_MMWSLENTRY' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], } ], '_WOW64_PROCESS' : [ 0x8, { 'Wow64' : [ 0x0, ['pointer64', ['void']]], @@ -6095,14 +6095,14 @@ ntkrnlmp_types = { 'Exchg' : [ 0x0, ['long long']], } ], '_WHEA_TIMESTAMP' : [ 0x8, { - 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40)]], - 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48)]], - 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56)]], - 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64)]], + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], } ], '_PEB32' : [ 0x238, { @@ -6110,12 +6110,12 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['unsigned long']], 'ImageBaseAddress' : [ 0x8, ['unsigned long']], 'Ldr' : [ 0xc, ['unsigned long']], @@ -6126,11 +6126,11 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x20, ['unsigned long']], 'IFEOKey' : [ 0x24, ['unsigned long']], 'CrossProcessFlags' : [ 0x28, ['unsigned long']], - 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x2c, ['unsigned long']], 'UserSharedInfoPtr' : [ 0x2c, ['unsigned long']], 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], @@ -6222,9 +6222,9 @@ ntkrnlmp_types = { 'GenericAll' : [ 0xc, ['unsigned long']], } ], '_KBUGCHECK_ACTIVE_STATE' : [ 0x4, { - 'BugCheckState' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'RecursionCount' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'BugCheckOwner' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'BugCheckState' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'RecursionCount' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'BugCheckOwner' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['long']], } ], '_PF_KERNEL_GLOBALS' : [ 0x60, { @@ -6269,12 +6269,12 @@ ntkrnlmp_types = { 'HandleAttributes' : [ 0x28, ['unsigned long']], } ], '_MMPTE_SUBSECTION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_POWER_STATE' : [ 0x4, { 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], @@ -6377,22 +6377,22 @@ ntkrnlmp_types = { 'ReserveDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], } ], '_MMPTE_HARDWARE_LARGEPAGE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PAT' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 21)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 48)]], - 'reserved2' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PAT' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 21, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 48, native_type='unsigned long long')]], + 'reserved2' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '_KUSER_SHARED_DATA' : [ 0x3b8, { 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], @@ -6428,14 +6428,14 @@ ntkrnlmp_types = { 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], 'SafeBootMode' : [ 0x2ec, ['unsigned char']], 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], - 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], 'SystemCall' : [ 0x300, ['unsigned long']], 'SystemCallReturn' : [ 0x304, ['unsigned long']], @@ -6473,7 +6473,7 @@ ntkrnlmp_types = { 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], } ], '__unnamed_1d2e' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMSUBSECTION_NODE']]], } ], '_MMSUBSECTION_NODE' : [ 0x28, { @@ -6515,21 +6515,21 @@ ntkrnlmp_types = { } ], '_WHEA_ERROR_STATUS' : [ 0x8, { 'ErrorStatus' : [ 0x0, ['unsigned long long']], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { - 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], 'AsUCHAR' : [ 0x0, ['unsigned char']], } ], '_FS_FILTER_CALLBACKS' : [ 0x68, { @@ -6684,10 +6684,10 @@ ntkrnlmp_types = { 'BankTemplate' : [ 0x30, ['array', 1, ['_MMPTE']]], } ], '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { - 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_WHEA_PCIEXPRESS_ERROR' : [ 0xd0, { @@ -6719,11 +6719,11 @@ ntkrnlmp_types = { } ], '__unnamed_1da8' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'UsingHypervisor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'UsingHypervisor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_PERF_STATES' : [ 0x98, { 'Count' : [ 0x0, ['unsigned long']], @@ -6828,8 +6828,8 @@ ntkrnlmp_types = { 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], } ], '_WHEA_NMI_ERROR_FLAGS' : [ 0x4, { - 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_M128A' : [ 0x10, { @@ -6926,10 +6926,10 @@ ntkrnlmp_types = { '_IMAGE_SECURITY_CONTEXT' : [ 0x8, { 'PageHashes' : [ 0x0, ['pointer64', ['void']]], 'Value' : [ 0x0, ['unsigned long long']], - 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64)]], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_1e04' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], @@ -7008,8 +7008,8 @@ ntkrnlmp_types = { 'FirmwareDescriptorListHead' : [ 0x68, ['_LIST_ENTRY']], 'AcpiTable' : [ 0x78, ['pointer64', ['void']]], 'AcpiTableSize' : [ 0x80, ['unsigned long']], - 'BootViaWinload' : [ 0x84, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x84, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'BootViaWinload' : [ 0x84, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x84, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'LoaderPerformanceData' : [ 0x88, ['pointer64', ['_LOADER_PERFORMANCE_DATA']]], 'BootApplicationPersistentData' : [ 0x90, ['_LIST_ENTRY']], 'WmdTestResult' : [ 0xa0, ['pointer64', ['void']]], @@ -7103,11 +7103,11 @@ ntkrnlmp_types = { 'PeakNonPagedBytes' : [ 0x98, ['unsigned long long']], } ], '_RTL_SRWLOCK' : [ 0x8, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], 'Ptr' : [ 0x0, ['pointer64', ['void']]], } ], @@ -7204,10 +7204,10 @@ ntkrnlmp_types = { 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], } ], '_POOL_HEADER' : [ 0x10, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'ProcessBilled' : [ 0x8, ['pointer64', ['_EPROCESS']]], @@ -7225,12 +7225,12 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['unsigned long long']], 'ImageBaseAddress' : [ 0x10, ['unsigned long long']], 'Ldr' : [ 0x18, ['unsigned long long']], @@ -7241,11 +7241,11 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x40, ['unsigned long long']], 'IFEOKey' : [ 0x48, ['unsigned long long']], 'CrossProcessFlags' : [ 0x50, ['unsigned long']], - 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x58, ['unsigned long long']], 'UserSharedInfoPtr' : [ 0x58, ['unsigned long long']], 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], @@ -7378,8 +7378,8 @@ ntkrnlmp_types = { } ], '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x10, { 'Process' : [ 0x0, ['pointer64', ['_EPROCESS']]], - 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_CLIENT_ID' : [ 0x10, { 'UniqueProcess' : [ 0x0, ['pointer64', ['void']]], @@ -7387,8 +7387,8 @@ ntkrnlmp_types = { } ], '_VI_DEADLOCK_RESOURCE' : [ 0xf8, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer64', ['void']]], 'ThreadOwner' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x18, ['_LIST_ENTRY']], @@ -7411,33 +7411,33 @@ ntkrnlmp_types = { 'Privilege' : [ 0x8, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], } ], '_SECURITY_CLIENT_CONTEXT' : [ 0x48, { 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], @@ -7620,9 +7620,9 @@ ntkrnlmp_types = { } ], '__unnamed_1f31' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { 'Revision' : [ 0x0, ['unsigned short']], @@ -7708,36 +7708,36 @@ ntkrnlmp_types = { 'DefaultLowLatencyWake' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], } ], '_WHEA_MEMORY_ERROR_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '_WHEA_PCIEXPRESS_DEVICE_ID' : [ 0x10, { 'VendorID' : [ 0x0, ['unsigned short']], 'DeviceID' : [ 0x2, ['unsigned short']], - 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Segment' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 24)]], - 'PrimaryBusNumber' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'SecondaryBusNumber' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 10)]], - 'SlotNumber' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 24)]], - 'Reserved2' : [ 0xc, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Segment' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 24, native_type='unsigned long')]], + 'PrimaryBusNumber' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'SecondaryBusNumber' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 10, native_type='unsigned long')]], + 'SlotNumber' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 24, native_type='unsigned long')]], + 'Reserved2' : [ 0xc, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_WNODE_HEADER' : [ 0x30, { 'BufferSize' : [ 0x0, ['unsigned long']], @@ -7777,12 +7777,12 @@ ntkrnlmp_types = { '_WHEA_PCIXDEVICE_ID' : [ 0x10, { 'VendorId' : [ 0x0, ['unsigned short']], 'DeviceId' : [ 0x2, ['unsigned short']], - 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'BusNumber' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'SegmentNumber' : [ 0x8, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'Reserved1' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'BusNumber' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'SegmentNumber' : [ 0x8, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'Reserved1' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'Reserved2' : [ 0xc, ['unsigned long']], } ], '_PCAT_FIRMWARE_INFORMATION' : [ 0x4, { @@ -7816,10 +7816,10 @@ ntkrnlmp_types = { 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], 'Security' : [ 0x2c, ['unsigned long']], 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'MaxClassLen' : [ 0x38, ['unsigned long']], 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], 'MaxValueDataLen' : [ 0x40, ['unsigned long']], @@ -7846,10 +7846,10 @@ ntkrnlmp_types = { 'Offset' : [ 0x30, ['unsigned long']], 'Length' : [ 0x34, ['unsigned long']], 'Page' : [ 0x38, ['unsigned long long']], - 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'Spare' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Spare' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'CallingAddress' : [ 0x48, ['pointer64', ['void']]], 'CallersCaller' : [ 0x50, ['pointer64', ['void']]], } ], @@ -7940,15 +7940,15 @@ ntkrnlmp_types = { 'BitmapFailures' : [ 0x54, ['unsigned long']], } ], '_WHEA_PCIEXPRESS_ERROR_VALIDBITS' : [ 0x8, { - 'PortType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Version' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CommandStatus' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DeviceId' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DeviceSerialNumber' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'BridgeControlStatus' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ExpressCapability' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'AerInfo' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'PortType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Version' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'CommandStatus' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'DeviceId' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'DeviceSerialNumber' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'BridgeControlStatus' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'ExpressCapability' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'AerInfo' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '_ETW_REG_ENTRY' : [ 0x50, { @@ -8042,18 +8042,18 @@ ntkrnlmp_types = { 'TimeRefreshLockAcquired' : [ 0x2b4, ['unsigned char']], } ], '_SEGMENT_FLAGS' : [ 0x4, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22)]], - 'ContainsPxeSubsection' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22, native_type='unsigned long')]], + 'ContainsPxeSubsection' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_EX_WORK_QUEUE' : [ 0x58, { 'WorkerQueue' : [ 0x0, ['_KQUEUE']], @@ -8149,19 +8149,19 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], - 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0xfca, ['unsigned short']], - 'DbgSafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgInDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgHasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgSkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgWerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgRanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DbgSuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RtlDisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 16)]], + 'DbgSafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgInDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgHasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgSkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgWerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgRanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgSuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RtlDisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], @@ -8199,13 +8199,13 @@ ntkrnlmp_types = { 'StateType' : [ 0x24, ['unsigned char']], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { - 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_KRESOURCEMANAGER' : [ 0x250, { diff --git a/volatility/plugins/overlays/windows/vista_sp1_x86_vtypes.py b/volatility/plugins/overlays/windows/vista_sp1_x86_vtypes.py index a20044f5..4cb9ca0b 100644 --- a/volatility/plugins/overlays/windows/vista_sp1_x86_vtypes.py +++ b/volatility/plugins/overlays/windows/vista_sp1_x86_vtypes.py @@ -1,4 +1,4 @@ -nt_types = { +ntkrnlmp_types = { '_KRESOURCEMANAGER_COMPLETION_BINDING' : [ 0x14, { 'NotificationListHead' : [ 0x0, ['_LIST_ENTRY']], 'Port' : [ 0x8, ['pointer', ['void']]], @@ -30,12 +30,12 @@ nt_types = { 'Reserved' : [ 0x2c, ['array', 3, ['unsigned long']]], } ], '_WHEA_PERSISTENCE_INFO' : [ 0x8, { - 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40)]], - 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56)]], - 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58)]], - 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64)]], + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], 'AsULONGLONG' : [ 0x0, ['unsigned long long']], } ], '_MI_SECTION_IMAGE_INFORMATION' : [ 0x38, { @@ -109,11 +109,11 @@ nt_types = { 'Machine' : [ 0x20, ['unsigned short']], 'ImageContainsCode' : [ 0x22, ['unsigned char']], 'ImageFlags' : [ 0x23, ['unsigned char']], - 'ComPlusNativeReady' : [ 0x23, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ComPlusILOnly' : [ 0x23, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ImageDynamicallyRelocated' : [ 0x23, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ImageMappedFlat' : [ 0x23, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x23, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ComPlusNativeReady' : [ 0x23, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x23, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x23, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x23, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x23, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'LoaderFlags' : [ 0x24, ['unsigned long']], 'ImageFileSize' : [ 0x28, ['unsigned long']], 'CheckSum' : [ 0x2c, ['unsigned long']], @@ -267,20 +267,20 @@ nt_types = { 'Dacl' : [ 0x10, ['unsigned long']], } ], '_WHEA_GENERIC_PROCESSOR_ERROR_VALIDBITS' : [ 0x8, { - 'ProcessorType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InstructionSet' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Operation' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Flags' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Level' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CPUVersion' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'CPUBrandString' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ProcessorId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'TargetAddress' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'InstructionPointer' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 64)]], + 'ProcessorType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'InstructionSet' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Operation' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Flags' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Level' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'CPUVersion' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'CPUBrandString' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'ProcessorId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'TargetAddress' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'InstructionPointer' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '__unnamed_2072' : [ 0x10, { @@ -339,10 +339,10 @@ nt_types = { 'ResumeContextPages' : [ 0xec, ['unsigned long']], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'BATTERY_REPORTING_SCALE' : [ 0x8, { @@ -372,13 +372,13 @@ nt_types = { 'HiberFileResumeTime' : [ 0x58, ['unsigned long long']], } ], '_DEVICE_FLAGS' : [ 0x4, { - 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], } ], '_RTL_BALANCED_LINKS' : [ 0x10, { 'Parent' : [ 0x0, ['pointer', ['_RTL_BALANCED_LINKS']]], @@ -389,18 +389,18 @@ nt_types = { } ], '_MMVIEW' : [ 0x8, { 'Entry' : [ 0x0, ['unsigned long']], - 'Writable' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Writable' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], 'ControlArea' : [ 0x4, ['pointer', ['_CONTROL_AREA']]], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x20, { 'Type' : [ 0x0, ['unsigned short']], @@ -688,8 +688,8 @@ nt_types = { 'QuadPart' : [ 0x0, ['long long']], } ], '__unnamed_1037' : [ 0x4, { - 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Private' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1039' : [ 0x4, { 'Flags' : [ 0x0, ['unsigned long']], @@ -1010,15 +1010,15 @@ nt_types = { 'WaitStatus' : [ 0x60, ['long']], 'WaitBlockList' : [ 0x64, ['pointer', ['_KWAIT_BLOCK']]], 'GateObject' : [ 0x64, ['pointer', ['_KGATE']]], - 'KernelStackResident' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadyTransition' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessReadyQueue' : [ 0x68, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WaitNext' : [ 0x68, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemAffinityActive' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Alertable' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'GdiFlushActive' : [ 0x68, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'UserStackWalkActive' : [ 0x68, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Reserved' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'KernelStackResident' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessReadyQueue' : [ 0x68, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WaitNext' : [ 0x68, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Alertable' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GdiFlushActive' : [ 0x68, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x68, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x68, ['long']], 'WaitReason' : [ 0x6c, ['unsigned char']], 'SwapBusy' : [ 0x6d, ['unsigned char']], @@ -1033,16 +1033,16 @@ nt_types = { 'Teb' : [ 0x84, ['pointer', ['void']]], 'Timer' : [ 0x88, ['_KTIMER']], 'TimerFill' : [ 0x88, ['array', 40, ['unsigned char']]], - 'AutoAlignment' : [ 0xb0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xb0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwStackTraceApc1Inserted' : [ 0xb0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EtwStackTraceApc2Inserted' : [ 0xb0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CycleChargePending' : [ 0xb0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'CalloutActive' : [ 0xb0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ApcQueueable' : [ 0xb0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'EnableStackSwap' : [ 0xb0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'GuiThread' : [ 0xb0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'ReservedFlags' : [ 0xb0, ['BitField', dict(start_bit = 9, end_bit = 32)]], + 'AutoAlignment' : [ 0xb0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0xb0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'EtwStackTraceApc1Inserted' : [ 0xb0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EtwStackTraceApc2Inserted' : [ 0xb0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CycleChargePending' : [ 0xb0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CalloutActive' : [ 0xb0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ApcQueueable' : [ 0xb0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0xb0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'GuiThread' : [ 0xb0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xb0, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], 'ThreadFlags' : [ 0xb0, ['long']], 'WaitBlock' : [ 0xb8, ['array', 4, ['_KWAIT_BLOCK']]], 'WaitBlockFill0' : [ 0xb8, ['array', 23, ['unsigned char']]], @@ -1138,11 +1138,11 @@ nt_types = { 'Information' : [ 0x4, ['unsigned long']], } ], '_EX_PUSH_LOCK' : [ 0x4, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -1175,7 +1175,7 @@ nt_types = { } ], '_EX_FAST_REF' : [ 0x4, { 'Object' : [ 0x0, ['pointer', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], } ], '_EX_PUSH_LOCK_WAIT_BLOCK' : [ 0x30, { @@ -1219,45 +1219,45 @@ nt_types = { 'ReadClusterSize' : [ 0x258, ['unsigned long']], 'MmLockOrdering' : [ 0x25c, ['long']], 'CrossThreadFlags' : [ 0x260, ['unsigned long']], - 'Terminated' : [ 0x260, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ThreadInserted' : [ 0x260, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x260, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x260, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x260, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x260, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x260, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x260, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x260, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyTokenOnOpen' : [ 0x260, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ThreadIoPriority' : [ 0x260, ['BitField', dict(start_bit = 10, end_bit = 13)]], - 'ThreadPagePriority' : [ 0x260, ['BitField', dict(start_bit = 13, end_bit = 16)]], - 'RundownFail' : [ 0x260, ['BitField', dict(start_bit = 16, end_bit = 17)]], + 'Terminated' : [ 0x260, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x260, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x260, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x260, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x260, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x260, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x260, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x260, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x260, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x260, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x260, ['BitField', dict(start_bit = 10, end_bit = 13, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x260, ['BitField', dict(start_bit = 13, end_bit = 16, native_type='unsigned long')]], + 'RundownFail' : [ 0x260, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x264, ['unsigned long']], - 'ActiveExWorker' : [ 0x264, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x264, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x264, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ClonedThread' : [ 0x264, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'KeyedEventInUse' : [ 0x264, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RateApcState' : [ 0x264, ['BitField', dict(start_bit = 5, end_bit = 7)]], - 'SelfTerminate' : [ 0x264, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveExWorker' : [ 0x264, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x264, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x264, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x264, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x264, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RateApcState' : [ 0x264, ['BitField', dict(start_bit = 5, end_bit = 7, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x264, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x268, ['unsigned long']], - 'Spare' : [ 0x268, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'StartAddressInvalid' : [ 0x268, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwPageFaultCalloutActive' : [ 0x268, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x268, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemWorkingSetShared' : [ 0x268, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x269, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsProcessAddressSpaceExclusive' : [ 0x269, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsProcessAddressSpaceShared' : [ 0x269, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SuppressSymbolLoad' : [ 0x269, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Prefetching' : [ 0x269, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsDynamicMemoryShared' : [ 0x269, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsChangeControlAreaExclusive' : [ 0x269, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsChangeControlAreaShared' : [ 0x269, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Spare1' : [ 0x26a, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Spare' : [ 0x268, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x268, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EtwPageFaultCalloutActive' : [ 0x268, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x268, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemWorkingSetShared' : [ 0x268, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x269, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceExclusive' : [ 0x269, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x269, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x269, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Prefetching' : [ 0x269, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsDynamicMemoryShared' : [ 0x269, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsChangeControlAreaExclusive' : [ 0x269, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsChangeControlAreaShared' : [ 0x269, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare1' : [ 0x26a, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], 'PriorityRegionActive' : [ 0x26b, ['unsigned char']], 'CacheManagerActive' : [ 0x26c, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x26d, ['unsigned char']], @@ -1285,7 +1285,7 @@ nt_types = { 'DebugPort' : [ 0xd4, ['pointer', ['void']]], 'ExceptionPortData' : [ 0xd8, ['pointer', ['void']]], 'ExceptionPortValue' : [ 0xd8, ['unsigned long']], - 'ExceptionPortState' : [ 0xd8, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'ExceptionPortState' : [ 0xd8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'ObjectTable' : [ 0xdc, ['pointer', ['_HANDLE_TABLE']]], 'Token' : [ 0xe0, ['_EX_FAST_REF']], 'WorkingSetPage' : [ 0xe4, ['unsigned long']], @@ -1340,55 +1340,55 @@ nt_types = { 'MmProcessLinks' : [ 0x218, ['_LIST_ENTRY']], 'ModifiedPageCount' : [ 0x220, ['unsigned long']], 'Flags2' : [ 0x224, ['unsigned long']], - 'JobNotReallyActive' : [ 0x224, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AccountingFolded' : [ 0x224, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'NewProcessReported' : [ 0x224, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ExitProcessReported' : [ 0x224, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReportCommitChanges' : [ 0x224, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LastReportMemory' : [ 0x224, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ReportPhysicalPageChanges' : [ 0x224, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'HandleTableRundown' : [ 0x224, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'NeedsHandleRundown' : [ 0x224, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RefTraceEnabled' : [ 0x224, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'NumaAware' : [ 0x224, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtectedProcess' : [ 0x224, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'DefaultPagePriority' : [ 0x224, ['BitField', dict(start_bit = 12, end_bit = 15)]], - 'PrimaryTokenFrozen' : [ 0x224, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessVerifierTarget' : [ 0x224, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'StackRandomizationDisabled' : [ 0x224, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'AffinityPermanent' : [ 0x224, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'AffinityUpdateEnable' : [ 0x224, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'CrossSessionCreate' : [ 0x224, ['BitField', dict(start_bit = 20, end_bit = 21)]], + 'JobNotReallyActive' : [ 0x224, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x224, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x224, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x224, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x224, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x224, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ReportPhysicalPageChanges' : [ 0x224, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'HandleTableRundown' : [ 0x224, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x224, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x224, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'NumaAware' : [ 0x224, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtectedProcess' : [ 0x224, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x224, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x224, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x224, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x224, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x224, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x224, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x224, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], 'Flags' : [ 0x228, ['unsigned long']], - 'CreateReported' : [ 0x228, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x228, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x228, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x228, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x228, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x228, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x228, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x228, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x228, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x228, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x228, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x228, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x228, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'DeprioritizeViews' : [ 0x228, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x228, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x228, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x228, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x228, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x228, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x228, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x228, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x228, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x228, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x228, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'SmapAllowed' : [ 0x228, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'ProcessInserted' : [ 0x228, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x228, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'ProcessSelfDelete' : [ 0x228, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'SpareProcessFlags' : [ 0x228, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x228, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x228, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x228, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x228, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x228, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x228, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x228, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x228, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x228, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x228, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x228, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x228, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x228, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x228, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x228, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x228, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x228, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x228, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x228, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x228, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x228, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x228, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x228, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x228, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SmapAllowed' : [ 0x228, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x228, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x228, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x228, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SpareProcessFlags' : [ 0x228, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x22c, ['long']], 'Spare7' : [ 0x230, ['unsigned short']], 'SubSystemMinorVersion' : [ 0x232, ['unsigned char']], @@ -1875,10 +1875,10 @@ nt_types = { 'ThreadListHead' : [ 0x50, ['_LIST_ENTRY']], 'ProcessLock' : [ 0x58, ['unsigned long']], 'Affinity' : [ 0x5c, ['unsigned long']], - 'AutoAlignment' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x60, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0x60, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ReservedFlags' : [ 0x60, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'AutoAlignment' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x60, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x60, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ReservedFlags' : [ 0x60, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='long')]], 'ProcessFlags' : [ 0x60, ['long']], 'BasePriority' : [ 0x64, ['unsigned char']], 'QuantumReset' : [ 0x65, ['unsigned char']], @@ -1998,11 +1998,11 @@ nt_types = { 'e3' : [ 0x0, ['__unnamed_142b']], } ], '__unnamed_1432' : [ 0x4, { - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25)]], - 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], } ], '_MMPFN' : [ 0x18, { 'u1' : [ 0x0, ['__unnamed_1424']], @@ -2064,10 +2064,10 @@ nt_types = { 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], 'WritableUserReferences' : [ 0x4, ['long']], - 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30)]], - 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30, native_type='unsigned long')]], + 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubsectionRoot' : [ 0x8, ['pointer', ['_MM_SUBSECTION_AVL_TABLE']]], 'SeImageStub' : [ 0x8, ['pointer', ['_MI_IMAGE_SECURITY_REFERENCE']]], } ], @@ -2103,11 +2103,11 @@ nt_types = { 'Bitmap' : [ 0x2c, ['pointer', ['_RTL_BITMAP']]], 'BitmapHint' : [ 0x30, ['unsigned long']], 'LastAllocationSize' : [ 0x34, ['unsigned long']], - 'PageFileNumber' : [ 0x38, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'BootPartition' : [ 0x38, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Spare0' : [ 0x38, ['BitField', dict(start_bit = 5, end_bit = 16)]], - 'AdriftMdls' : [ 0x3a, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare1' : [ 0x3a, ['BitField', dict(start_bit = 1, end_bit = 16)]], + 'PageFileNumber' : [ 0x38, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'BootPartition' : [ 0x38, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Spare0' : [ 0x38, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x3a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare1' : [ 0x3a, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], 'FileHandle' : [ 0x3c, ['pointer', ['void']]], 'AvailableList' : [ 0x40, ['_SLIST_HEADER']], 'NeedProcessingList' : [ 0x48, ['_SLIST_HEADER']], @@ -2121,7 +2121,7 @@ nt_types = { 'Buffer' : [ 0x4, ['pointer', ['unsigned long']]], } ], '__unnamed_149d' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMVAD']]], } ], '__unnamed_14a0' : [ 0x4, { @@ -2144,9 +2144,9 @@ nt_types = { } ], '_MM_AVL_TABLE' : [ 0x20, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'NodeHint' : [ 0x18, ['pointer', ['void']]], 'NodeFreeHint' : [ 0x1c, ['pointer', ['void']]], } ], @@ -2170,7 +2170,7 @@ nt_types = { 'LastContiguousPte' : [ 0x2c, ['pointer', ['_MMPTE']]], } ], '__unnamed_14bc' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x14, { @@ -2196,7 +2196,7 @@ nt_types = { 'NumberOfFullSectors' : [ 0x1c, ['unsigned long']], } ], '__unnamed_14c7' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMADDRESS_NODE']]], 'NextToFree' : [ 0x0, ['pointer', ['_MI_PER_SESSION_PROTOS']]], } ], @@ -2381,19 +2381,19 @@ nt_types = { 'MergedPrefLanguages' : [ 0xfc0, ['pointer', ['void']]], 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], - 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0xfca, ['unsigned short']], - 'DbgSafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgInDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgHasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgSkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgWerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgRanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DbgSuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RtlDisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 16)]], + 'DbgSafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgInDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgHasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgSkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgWerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgRanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgSuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RtlDisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0xfcc, ['pointer', ['void']]], 'TxnScopeExitCallback' : [ 0xfd0, ['pointer', ['void']]], 'TxnScopeContext' : [ 0xfd4, ['pointer', ['void']]], @@ -2449,9 +2449,9 @@ nt_types = { } ], '__unnamed_15b8' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'PStateDomain' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PStateDomainIdleAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'PStateDomain' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'PStateDomainIdleAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], '_PROCESSOR_POWER_STATE' : [ 0xc8, { 'IdleStates' : [ 0x0, ['pointer', ['_PPM_IDLE_STATES']]], @@ -2497,9 +2497,9 @@ nt_types = { 'PreviousTrapFrame' : [ 0x0, ['pointer', ['_KTRAP_FRAME']]], 'PreviousExceptionList' : [ 0x0, ['pointer', ['void']]], 'StackControlFlags' : [ 0x4, ['unsigned long']], - 'PreviousLargeStack' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousSegmentsPresent' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ExpandCalloutStack' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'PreviousLargeStack' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousSegmentsPresent' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ExpandCalloutStack' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'Previous' : [ 0x8, ['_KERNEL_STACK_SEGMENT']], } ], '_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x2c, { @@ -3170,19 +3170,19 @@ nt_types = { 'BufferSequenceNumber' : [ 0x248, ['long long']], 'AcceptNewEvents' : [ 0x250, ['long']], 'Flags' : [ 0x254, ['unsigned long']], - 'Persistent' : [ 0x254, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoLogger' : [ 0x254, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'FsReady' : [ 0x254, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RealTime' : [ 0x254, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow' : [ 0x254, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelTrace' : [ 0x254, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'NoMoreEnable' : [ 0x254, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Persistent' : [ 0x254, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x254, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x254, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x254, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x254, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x254, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x254, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], 'RequestFlag' : [ 0x258, ['unsigned long']], - 'RequestNewFie' : [ 0x258, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'RequestUpdateFile' : [ 0x258, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'RequestFlush' : [ 0x258, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RequestDisableRealtime' : [ 0x258, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RequestDisconnectConsumer' : [ 0x258, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'RequestNewFie' : [ 0x258, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RequestUpdateFile' : [ 0x258, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'RequestFlush' : [ 0x258, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RequestDisableRealtime' : [ 0x258, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequestDisconnectConsumer' : [ 0x258, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], 'StackTraceFilterHookCount' : [ 0x25c, ['unsigned short']], 'StackTraceFilter' : [ 0x25e, ['array', 16, ['unsigned short']]], } ], @@ -3240,8 +3240,8 @@ nt_types = { 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], 'LoggerId' : [ 0x8, ['unsigned short']], 'Level' : [ 0xa, ['unsigned char']], - 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_TRACE_ENABLE_CONTEXT' : [ 0x8, { 'LoggerId' : [ 0x0, ['unsigned short']], @@ -3317,10 +3317,10 @@ nt_types = { 'Object' : [ 0x0, ['pointer', ['void']]], } ], '__unnamed_1812' : [ 0x1, { - 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], } ], '__unnamed_1814' : [ 0x1, { 's1' : [ 0x0, ['__unnamed_1812']], @@ -3337,8 +3337,8 @@ nt_types = { 'Pad' : [ 0x14, ['unsigned long']], } ], '__unnamed_181c' : [ 0x4, { - 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_181e' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_181c']], @@ -3355,7 +3355,7 @@ nt_types = { 'RegionListHead' : [ 0x20, ['_LIST_ENTRY']], } ], '__unnamed_182b' : [ 0x4, { - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], } ], '__unnamed_182d' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_182b']], @@ -3373,9 +3373,9 @@ nt_types = { 'ViewListHead' : [ 0x28, ['_LIST_ENTRY']], } ], '__unnamed_1833' : [ 0x4, { - 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], } ], '__unnamed_1835' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1833']], @@ -3401,21 +3401,21 @@ nt_types = { 'HandleTable' : [ 0x14, ['_ALPC_HANDLE_TABLE']], } ], '__unnamed_184d' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], } ], '__unnamed_184f' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_184d']], @@ -3455,16 +3455,16 @@ nt_types = { 'WaitQueueLength' : [ 0xf0, ['unsigned long']], } ], '__unnamed_1866' : [ 0x4, { - 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], } ], '__unnamed_1868' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1866']], @@ -3515,8 +3515,8 @@ nt_types = { 'HandleData' : [ 0x18, ['pointer', ['_KALPC_HANDLE_DATA']]], } ], '__unnamed_18a6' : [ 0x4, { - 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_18a8' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_18a6']], @@ -3641,16 +3641,16 @@ nt_types = { '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x4, { 'ImpersonationData' : [ 0x0, ['unsigned long']], 'ImpersonationToken' : [ 0x0, ['pointer', ['void']]], - 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], } ], '_MMVAD_FLAGS3' : [ 0x4, { - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6)]], - 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24)]], - 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned long')]], + 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24, native_type='unsigned long')]], + 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_MI_VERIFIER_POOL_HEADER' : [ 0x4, { 'VerifierPoolEntry' : [ 0x0, ['pointer', ['_VI_POOL_ENTRY']]], @@ -3708,19 +3708,19 @@ nt_types = { 'Request' : [ 0x18, ['_PORT_MESSAGE']], } ], '_HARDWARE_PTE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_DUAL' : [ 0x13c, { 'Length' : [ 0x0, ['unsigned long']], @@ -3755,8 +3755,8 @@ nt_types = { 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], 'FileOffset' : [ 0x0, ['unsigned long long']], 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], - 'DontUse0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'DontUse0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'PointerProtoPte' : [ 0x4, ['pointer', ['void']]], } ], '_HEAP_COUNTERS' : [ 0x48, { @@ -3851,7 +3851,7 @@ nt_types = { 'DebugInfo' : [ 0x1c, ['pointer', ['_HANDLE_TRACE_DEBUG_INFO']]], 'ExtraInfoPages' : [ 0x20, ['long']], 'Flags' : [ 0x24, ['unsigned long']], - 'StrictFIFO' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], 'FirstFreeHandle' : [ 0x28, ['long']], 'LastFreeHandleEntry' : [ 0x2c, ['pointer', ['_HANDLE_TABLE_ENTRY']]], 'HandleCount' : [ 0x30, ['long']], @@ -3864,15 +3864,15 @@ nt_types = { 'NumberOfBytes' : [ 0xc, ['unsigned long']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_VI_CANCEL_GLOBALS' : [ 0x6c, { 'CancelLock' : [ 0x0, ['unsigned long']], @@ -3908,18 +3908,18 @@ nt_types = { 'ContextListHead' : [ 0x24, ['_LIST_ENTRY']], } ], '_MMPTE_PROTOTYPE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 9)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 9, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CpuValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CpuValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_THERMAL_INFORMATION_EX' : [ 0x50, { @@ -3936,15 +3936,15 @@ nt_types = { 'S4TransitionTripPoint' : [ 0x4c, ['unsigned long']], } ], '__unnamed_1995' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], } ], '__unnamed_1997' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], } ], '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { 'File' : [ 0x0, ['__unnamed_1995']], @@ -3956,14 +3956,14 @@ nt_types = { 'Parameters' : [ 0x8, ['array', 2, ['unsigned long']]], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16)]], - 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16)]], + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], } ], '_EXCEPTION_POINTERS' : [ 0x8, { 'ExceptionRecord' : [ 0x0, ['pointer', ['_EXCEPTION_RECORD']]], @@ -4077,9 +4077,9 @@ nt_types = { 'u4' : [ 0x38, ['__unnamed_19cc']], } ], '_MMWSLE_FREE_ENTRY' : [ 0x4, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 12)]], - 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 12, native_type='unsigned long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_NT_TIB' : [ 0x1c, { 'ExceptionList' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], @@ -4137,11 +4137,11 @@ nt_types = { } ], '__unnamed_19dc' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Hypervisor' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Hypervisor' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_IDLE_STATES' : [ 0x3c, { 'Type' : [ 0x0, ['unsigned long']], @@ -4158,12 +4158,12 @@ nt_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['pointer', ['void']]], 'ImageBaseAddress' : [ 0x8, ['pointer', ['void']]], 'Ldr' : [ 0xc, ['pointer', ['_PEB_LDR_DATA']]], @@ -4174,11 +4174,11 @@ nt_types = { 'AtlThunkSListPtr' : [ 0x20, ['pointer', ['void']]], 'IFEOKey' : [ 0x24, ['pointer', ['void']]], 'CrossProcessFlags' : [ 0x28, ['unsigned long']], - 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x2c, ['pointer', ['void']]], 'UserSharedInfoPtr' : [ 0x2c, ['pointer', ['void']]], 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], @@ -4244,8 +4244,8 @@ nt_types = { 'PcatInformation' : [ 0x0, ['_PCAT_FIRMWARE_INFORMATION']], } ], '_FIRMWARE_INFORMATION_LOADER_BLOCK' : [ 0x14, { - 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'u' : [ 0x4, ['__unnamed_19f4']], } ], '_HEAP_UCR_DESCRIPTOR' : [ 0x18, { @@ -4261,16 +4261,16 @@ nt_types = { 'BaseHi' : [ 0x3, ['unsigned char']], } ], '__unnamed_1a01' : [ 0x4, { - 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1a03' : [ 0x4, { 'Bytes' : [ 0x0, ['__unnamed_19fb']], @@ -4328,9 +4328,9 @@ nt_types = { 'PostList' : [ 0x8, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x10, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x14, ['pointer', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_KINTERRUPT' : [ 0x270, { @@ -4435,19 +4435,19 @@ nt_types = { 'Lock' : [ 0xc, ['_EX_PUSH_LOCK']], } ], '_MMPTE_HARDWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x8, { 'Port' : [ 0x0, ['pointer', ['void']]], @@ -4573,13 +4573,13 @@ nt_types = { 'RmLock' : [ 0x50, ['pointer', ['_ERESOURCE']]], } ], '_MMVAD_FLAGS' : [ 0x4, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_WHEA_PCIXDEVICE_ERROR' : [ 0x68, { 'ValidBits' : [ 0x0, ['_WHEA_PCIXDEVICE_ERROR_VALIDBITS']], @@ -4637,10 +4637,10 @@ nt_types = { } ], '_VF_TRACKER_STAMP' : [ 0x8, { 'Thread' : [ 0x0, ['pointer', ['void']]], - 'Flags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'OldIrql' : [ 0x5, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'NewIrql' : [ 0x6, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Processor' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Flags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x5, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0x6, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], } ], '_VI_TRACK_IRQL' : [ 0x20, { 'Thread' : [ 0x0, ['pointer', ['void']]], @@ -4680,11 +4680,11 @@ nt_types = { } ], '_CM_KEY_CONTROL_BLOCK' : [ 0x90, { 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 22)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 22, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x8, ['unsigned long']], 'NextHash' : [ 0xc, ['pointer', ['_CM_KEY_HASH']]], @@ -4705,10 +4705,10 @@ nt_types = { 'KcbMaxNameLen' : [ 0x58, ['unsigned short']], 'KcbMaxValueNameLen' : [ 0x5a, ['unsigned short']], 'KcbMaxValueDataLen' : [ 0x5c, ['unsigned long']], - 'KcbUserFlags' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'KcbVirtControlFlags' : [ 0x60, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'KcbDebug' : [ 0x60, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Flags' : [ 0x60, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'KcbUserFlags' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0x60, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0x60, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0x60, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'KCBUoWListHead' : [ 0x64, ['_LIST_ENTRY']], 'TransKCBOwner' : [ 0x6c, ['pointer', ['_CM_TRANS']]], 'KCBLock' : [ 0x70, ['_CM_INTENT_LOCK']], @@ -4718,12 +4718,12 @@ nt_types = { 'FullKCBName' : [ 0x8c, ['pointer', ['_UNICODE_STRING']]], } ], '_MMPTE_SOFTWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_CACHE_UNINITIALIZE_EVENT' : [ 0x14, { 'Next' : [ 0x0, ['pointer', ['_CACHE_UNINITIALIZE_EVENT']]], @@ -4749,9 +4749,9 @@ nt_types = { } ], '_MM_SUBSECTION_AVL_TABLE' : [ 0x20, { 'BalancedRoot' : [ 0x0, ['_MMSUBSECTION_NODE']], - 'DepthOfTree' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x18, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DepthOfTree' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x18, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'NodeHint' : [ 0x1c, ['pointer', ['void']]], } ], '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { @@ -4782,17 +4782,17 @@ nt_types = { 'DataValueHigh' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], - 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEGMENT_OBJECT' : [ 0x28, { 'BaseAddress' : [ 0x0, ['pointer', ['void']]], @@ -4885,22 +4885,22 @@ nt_types = { 'DataLength' : [ 0x8, ['unsigned long']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SessionMaster' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'TrimmerAttached' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'TrimmerDetaching' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 4)]], - 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SessionMaster' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'TrimmerAttached' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'TrimmerDetaching' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], } ], 'PPM_IDLE_ACCOUNTING' : [ 0x48, { 'StateCount' : [ 0x0, ['unsigned long']], @@ -5082,16 +5082,16 @@ nt_types = { 'List' : [ 0x8, ['_LIST_ENTRY']], } ], '_WHEA_PCIXBUS_ERROR_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BusId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'BusAddress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'BusData' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'BusCommand' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'CompleterId' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'BusId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'BusAddress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'BusData' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'BusCommand' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'CompleterId' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '__unnamed_1b68' : [ 0x4, { @@ -5190,25 +5190,25 @@ nt_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -5320,12 +5320,12 @@ nt_types = { 'Info' : [ 0x84, ['_THERMAL_INFORMATION_EX']], } ], '_MMPTE_LIST' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_VI_POOL_PAGE_HEADER' : [ 0xc, { 'NextPage' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], @@ -5351,9 +5351,9 @@ nt_types = { 'ByteOffset' : [ 0x18, ['unsigned long']], } ], '_WHEA_PCIXBUS_COMMAND' : [ 0x8, { - 'Command' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 56)]], - 'PCIXCommand' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 64)]], + 'Command' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 56, native_type='unsigned long long')]], + 'PCIXCommand' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 64, native_type='unsigned long long')]], 'AsULONGLONG' : [ 0x0, ['unsigned long long']], } ], '_CM_TRANS' : [ 0x68, { @@ -5371,10 +5371,10 @@ nt_types = { 'HiveArray' : [ 0x48, ['array', 8, ['pointer', ['_CMHIVE']]]], } ], '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { - 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x18, { @@ -5438,12 +5438,12 @@ nt_types = { 'PolicySetStatus' : [ 0x1b, ['unsigned char']], } ], '_MMPTE_TIMESTAMP' : [ 0x4, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_SID_AND_ATTRIBUTES_HASH' : [ 0x88, { 'SidCount' : [ 0x0, ['unsigned long']], @@ -5464,10 +5464,10 @@ nt_types = { } ], '__unnamed_1c2f' : [ 0x1, { 'AsUCHAR' : [ 0x0, ['unsigned char']], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], } ], 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { 'Revision' : [ 0x0, ['unsigned long']], @@ -5499,25 +5499,25 @@ nt_types = { 'Busy' : [ 0x10, ['unsigned char']], } ], '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'ContextAsUlong' : [ 0x0, ['unsigned long']], } ], '_OBJECT_TYPE_INITIALIZER' : [ 0x50, { 'Length' : [ 0x0, ['unsigned short']], 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], - 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], 'ObjectTypeCode' : [ 0x4, ['unsigned long']], 'InvalidAttributes' : [ 0x8, ['unsigned long']], 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], @@ -5563,14 +5563,14 @@ nt_types = { 'ActualLimit' : [ 0x10, ['unsigned long']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { 'Present' : [ 0x0, ['unsigned long long']], @@ -5578,12 +5578,12 @@ nt_types = { 'EnabledByDefault' : [ 0x10, ['unsigned long long']], } ], '_WHEA_PCIXDEVICE_ERROR_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IdInfo' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryNumber' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IoNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RegisterDataPairs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'IdInfo' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'MemoryNumber' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'IoNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'RegisterDataPairs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], 'WHEA_PCIXDEVICE_REGISTER_PAIR' : [ 0x10, { @@ -5610,14 +5610,14 @@ nt_types = { 'Reserved' : [ 0xc, ['unsigned long']], } ], '_MMWSLENTRY' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_DBGKD_SWITCH_PARTITION' : [ 0x4, { 'Partition' : [ 0x0, ['unsigned long']], @@ -5646,14 +5646,14 @@ nt_types = { 'Exchg' : [ 0x0, ['long long']], } ], '_WHEA_TIMESTAMP' : [ 0x8, { - 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40)]], - 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48)]], - 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56)]], - 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64)]], + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], } ], '_VPB' : [ 0x58, { @@ -5732,10 +5732,10 @@ nt_types = { 'HandleAttributes' : [ 0x18, ['unsigned long']], } ], '_MMPTE_SUBSECTION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_POWER_STATE' : [ 0x4, { 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], @@ -5871,14 +5871,14 @@ nt_types = { 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], 'SafeBootMode' : [ 0x2ec, ['unsigned char']], 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], - 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], 'SystemCall' : [ 0x300, ['unsigned long']], 'SystemCallReturn' : [ 0x304, ['unsigned long']], @@ -5916,7 +5916,7 @@ nt_types = { 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], } ], '__unnamed_1cfb' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMSUBSECTION_NODE']]], } ], '_MMSUBSECTION_NODE' : [ 0x18, { @@ -5958,21 +5958,21 @@ nt_types = { } ], '_WHEA_ERROR_STATUS' : [ 0x8, { 'ErrorStatus' : [ 0x0, ['unsigned long long']], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { - 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], 'AsUCHAR' : [ 0x0, ['unsigned char']], } ], '_FS_FILTER_CALLBACKS' : [ 0x38, { @@ -6127,10 +6127,10 @@ nt_types = { 'BankTemplate' : [ 0x1c, ['array', 1, ['_MMPTE']]], } ], '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { - 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_WHEA_PCIEXPRESS_ERROR' : [ 0xd0, { @@ -6201,11 +6201,11 @@ nt_types = { } ], '__unnamed_1d78' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'UsingHypervisor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'UsingHypervisor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_PERF_STATES' : [ 0x78, { 'Count' : [ 0x0, ['unsigned long']], @@ -6305,8 +6305,8 @@ nt_types = { 'Future' : [ 0x40, ['array', 2, ['unsigned long']]], } ], '_WHEA_NMI_ERROR_FLAGS' : [ 0x4, { - 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_HEAP_LOOKASIDE' : [ 0x30, { @@ -6399,10 +6399,10 @@ nt_types = { '_IMAGE_SECURITY_CONTEXT' : [ 0x4, { 'PageHashes' : [ 0x0, ['pointer', ['void']]], 'Value' : [ 0x0, ['unsigned long']], - 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1dcb' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], @@ -6483,8 +6483,8 @@ nt_types = { 'FirmwareDescriptorListHead' : [ 0x48, ['_LIST_ENTRY']], 'AcpiTable' : [ 0x50, ['pointer', ['void']]], 'AcpiTableSize' : [ 0x54, ['unsigned long']], - 'BootViaWinload' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'BootViaWinload' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'LoaderPerformanceData' : [ 0x5c, ['pointer', ['_LOADER_PERFORMANCE_DATA']]], 'BootApplicationPersistentData' : [ 0x60, ['_LIST_ENTRY']], 'WmdTestResult' : [ 0x68, ['pointer', ['void']]], @@ -6578,11 +6578,11 @@ nt_types = { 'PeakNonPagedBytes' : [ 0x54, ['unsigned long']], } ], '_RTL_SRWLOCK' : [ 0x4, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -6650,10 +6650,10 @@ nt_types = { 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], } ], '_POOL_HEADER' : [ 0x8, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16)]], - 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'AllocatorBackTraceIndex' : [ 0x4, ['unsigned short']], @@ -6734,8 +6734,8 @@ nt_types = { } ], '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x8, { 'Process' : [ 0x0, ['pointer', ['_EPROCESS']]], - 'HandleCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'LockCount' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'HandleCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_CLIENT_ID' : [ 0x8, { 'UniqueProcess' : [ 0x0, ['pointer', ['void']]], @@ -6743,8 +6743,8 @@ nt_types = { } ], '_VI_DEADLOCK_RESOURCE' : [ 0x80, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer', ['void']]], 'ThreadOwner' : [ 0xc, ['pointer', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x10, ['_LIST_ENTRY']], @@ -6767,33 +6767,33 @@ nt_types = { 'Privilege' : [ 0x8, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], } ], '_SECURITY_CLIENT_CONTEXT' : [ 0x3c, { 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], @@ -6972,9 +6972,9 @@ nt_types = { } ], '__unnamed_1eed' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { 'Revision' : [ 0x0, ['unsigned short']], @@ -7060,36 +7060,36 @@ nt_types = { 'DefaultLowLatencyWake' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], } ], '_WHEA_MEMORY_ERROR_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '_WHEA_PCIEXPRESS_DEVICE_ID' : [ 0x10, { 'VendorID' : [ 0x0, ['unsigned short']], 'DeviceID' : [ 0x2, ['unsigned short']], - 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Segment' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 24)]], - 'PrimaryBusNumber' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'SecondaryBusNumber' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 10)]], - 'SlotNumber' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 24)]], - 'Reserved2' : [ 0xc, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Segment' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 24, native_type='unsigned long')]], + 'PrimaryBusNumber' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'SecondaryBusNumber' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 10, native_type='unsigned long')]], + 'SlotNumber' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 24, native_type='unsigned long')]], + 'Reserved2' : [ 0xc, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_WNODE_HEADER' : [ 0x30, { 'BufferSize' : [ 0x0, ['unsigned long']], @@ -7129,12 +7129,12 @@ nt_types = { '_WHEA_PCIXDEVICE_ID' : [ 0x10, { 'VendorId' : [ 0x0, ['unsigned short']], 'DeviceId' : [ 0x2, ['unsigned short']], - 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'BusNumber' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'SegmentNumber' : [ 0x8, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'Reserved1' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'BusNumber' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'SegmentNumber' : [ 0x8, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'Reserved1' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'Reserved2' : [ 0xc, ['unsigned long']], } ], '_PCAT_FIRMWARE_INFORMATION' : [ 0x4, { @@ -7168,10 +7168,10 @@ nt_types = { 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], 'Security' : [ 0x2c, ['unsigned long']], 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'MaxClassLen' : [ 0x38, ['unsigned long']], 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], 'MaxValueDataLen' : [ 0x40, ['unsigned long']], @@ -7198,10 +7198,10 @@ nt_types = { 'Offset' : [ 0x18, ['unsigned long']], 'Length' : [ 0x1c, ['unsigned long']], 'Page' : [ 0x20, ['unsigned long']], - 'IoMapping' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Matched' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CacheAttribute' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'Spare' : [ 0x24, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'IoMapping' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Spare' : [ 0x24, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'CallingAddress' : [ 0x28, ['pointer', ['void']]], 'CallersCaller' : [ 0x2c, ['pointer', ['void']]], } ], @@ -7288,15 +7288,15 @@ nt_types = { 'BitmapFailures' : [ 0x34, ['unsigned long']], } ], '_WHEA_PCIEXPRESS_ERROR_VALIDBITS' : [ 0x8, { - 'PortType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Version' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CommandStatus' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DeviceId' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DeviceSerialNumber' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'BridgeControlStatus' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ExpressCapability' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'AerInfo' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'PortType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Version' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'CommandStatus' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'DeviceId' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'DeviceSerialNumber' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'BridgeControlStatus' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'ExpressCapability' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'AerInfo' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '_ETW_REG_ENTRY' : [ 0x2c, { @@ -7388,18 +7388,18 @@ nt_types = { 'TimeRefreshLockAcquired' : [ 0x184, ['unsigned char']], } ], '_SEGMENT_FLAGS' : [ 0x4, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22)]], - 'ContainsPxeSubsection' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22, native_type='unsigned long')]], + 'ContainsPxeSubsection' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_EX_WORK_QUEUE' : [ 0x3c, { 'WorkerQueue' : [ 0x0, ['_KQUEUE']], @@ -7441,13 +7441,13 @@ nt_types = { 'StateType' : [ 0x1c, ['unsigned char']], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { - 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_KRESOURCEMANAGER' : [ 0x154, { @@ -7615,9 +7615,9 @@ nt_types = { '_VF_BTS_RECORD' : [ 0xc, { 'JumpedFrom' : [ 0x0, ['pointer', ['void']]], 'JumpedTo' : [ 0x4, ['pointer', ['void']]], - 'Unused1' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Predicted' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 7)]], - 'Unused2' : [ 0x8, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Unused1' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Predicted' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'Unused2' : [ 0x8, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_KTRANSACTION' : [ 0x1e0, { 'OutcomeEvent' : [ 0x0, ['_KEVENT']], @@ -7663,11 +7663,11 @@ nt_types = { 'PromotionCompletedEvent' : [ 0x1cc, ['_KEVENT']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], } ], '_CM_KCB_UOW' : [ 0x38, { 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -7696,24 +7696,24 @@ nt_types = { 'SpecialRegisters' : [ 0x2cc, ['_KSPECIAL_REGISTERS']], } ], '_MMPTE_TRANSITION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '__unnamed_1fd5' : [ 0x8, { - 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48)]], - 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_1fd7' : [ 0x8, { 's1' : [ 0x0, ['__unnamed_1fd5']], @@ -7737,19 +7737,19 @@ nt_types = { 'Name' : [ 0xa, ['array', 1, ['wchar']]], } ], '_MMSECURE_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12, native_type='unsigned long')]], } ], '_PO_IRP_QUEUE' : [ 0x8, { 'CurrentIrp' : [ 0x0, ['pointer', ['_IRP']]], 'PendingIrpList' : [ 0x4, ['pointer', ['_IRP']]], } ], '__unnamed_1fe9' : [ 0x4, { - 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'Whole' : [ 0x0, ['unsigned long']], } ], '_VI_DEADLOCK_NODE' : [ 0x6c, { diff --git a/volatility/plugins/overlays/windows/vista_sp2_x64_vtypes.py b/volatility/plugins/overlays/windows/vista_sp2_x64_vtypes.py index eb10b586..e8c0dc6f 100644 --- a/volatility/plugins/overlays/windows/vista_sp2_x64_vtypes.py +++ b/volatility/plugins/overlays/windows/vista_sp2_x64_vtypes.py @@ -65,11 +65,11 @@ ntkrnlmp_types = { 'PromotionCompletedEvent' : [ 0x2c0, ['_KEVENT']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], } ], '_CM_KCB_UOW' : [ 0x60, { 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -94,29 +94,29 @@ ntkrnlmp_types = { 'ThisVolatileKeyCell' : [ 0x58, ['unsigned long']], } ], '_MMPTE_TRANSITION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '_KREQUEST_PACKET' : [ 0x20, { 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer64', ['void']]]], 'WorkerRoutine' : [ 0x18, ['pointer64', ['void']]], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '__unnamed_202c' : [ 0x8, { - 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48)]], - 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_202e' : [ 0x8, { 's1' : [ 0x0, ['__unnamed_202c']], @@ -140,19 +140,19 @@ ntkrnlmp_types = { 'Name' : [ 0x12, ['array', 1, ['wchar']]], } ], '_MMSECURE_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12, native_type='unsigned long')]], } ], '_PO_IRP_QUEUE' : [ 0x10, { 'CurrentIrp' : [ 0x0, ['pointer64', ['_IRP']]], 'PendingIrpList' : [ 0x8, ['pointer64', ['_IRP']]], } ], '__unnamed_2040' : [ 0x4, { - 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'Whole' : [ 0x0, ['unsigned long']], } ], '_VI_DEADLOCK_NODE' : [ 0xd0, { @@ -243,12 +243,12 @@ ntkrnlmp_types = { 'Reserved' : [ 0x30, ['array', 3, ['unsigned long']]], } ], '_WHEA_PERSISTENCE_INFO' : [ 0x8, { - 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40)]], - 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56)]], - 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58)]], - 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64)]], + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], 'AsULONGLONG' : [ 0x0, ['unsigned long long']], } ], '_MI_SECTION_IMAGE_INFORMATION' : [ 0x50, { @@ -327,11 +327,11 @@ ntkrnlmp_types = { 'Machine' : [ 0x30, ['unsigned short']], 'ImageContainsCode' : [ 0x32, ['unsigned char']], 'ImageFlags' : [ 0x33, ['unsigned char']], - 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'LoaderFlags' : [ 0x34, ['unsigned long']], 'ImageFileSize' : [ 0x38, ['unsigned long']], 'CheckSum' : [ 0x3c, ['unsigned long']], @@ -490,20 +490,20 @@ ntkrnlmp_types = { 'Dacl' : [ 0x10, ['unsigned long']], } ], '_WHEA_GENERIC_PROCESSOR_ERROR_VALIDBITS' : [ 0x8, { - 'ProcessorType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InstructionSet' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Operation' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Flags' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Level' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CPUVersion' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'CPUBrandString' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ProcessorId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'TargetAddress' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'InstructionPointer' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 64)]], + 'ProcessorType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'InstructionSet' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Operation' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Flags' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Level' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'CPUVersion' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'CPUBrandString' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'ProcessorId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'TargetAddress' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'InstructionPointer' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '__unnamed_20cd' : [ 0x20, { @@ -571,10 +571,10 @@ ntkrnlmp_types = { 'ResumeContextPages' : [ 0x130, ['unsigned long']], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'BATTERY_REPORTING_SCALE' : [ 0x8, { @@ -604,13 +604,13 @@ ntkrnlmp_types = { 'HiberFileResumeTime' : [ 0x58, ['unsigned long long']], } ], '_DEVICE_FLAGS' : [ 0x4, { - 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], } ], '_RTL_BALANCED_LINKS' : [ 0x20, { 'Parent' : [ 0x0, ['pointer64', ['_RTL_BALANCED_LINKS']]], @@ -621,18 +621,18 @@ ntkrnlmp_types = { } ], '_MMVIEW' : [ 0x10, { 'Entry' : [ 0x0, ['unsigned long long']], - 'Writable' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Writable' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], 'ControlArea' : [ 0x8, ['pointer64', ['_CONTROL_AREA']]], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x30, { 'Type' : [ 0x0, ['unsigned short']], @@ -832,11 +832,11 @@ ntkrnlmp_types = { '_KIDTENTRY64' : [ 0x10, { 'OffsetLow' : [ 0x0, ['unsigned short']], 'Selector' : [ 0x2, ['unsigned short']], - 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned short')]], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned short')]], + 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned short')]], + 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], 'OffsetMiddle' : [ 0x6, ['unsigned short']], 'OffsetHigh' : [ 0x8, ['unsigned long']], 'Reserved1' : [ 0xc, ['unsigned long']], @@ -873,16 +873,16 @@ ntkrnlmp_types = { 'BaseHigh' : [ 0x3, ['unsigned char']], } ], '__unnamed_214f' : [ 0x4, { - 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_KGDTENTRY64' : [ 0x10, { 'LimitLow' : [ 0x0, ['unsigned short']], @@ -947,8 +947,8 @@ ntkrnlmp_types = { 'QuadPart' : [ 0x0, ['long long']], } ], '__unnamed_103d' : [ 0x4, { - 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Private' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_103f' : [ 0x4, { 'Flags' : [ 0x0, ['unsigned long']], @@ -1210,15 +1210,15 @@ ntkrnlmp_types = { 'WaitStatus' : [ 0x80, ['long long']], 'WaitBlockList' : [ 0x88, ['pointer64', ['_KWAIT_BLOCK']]], 'GateObject' : [ 0x88, ['pointer64', ['_KGATE']]], - 'KernelStackResident' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadyTransition' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessReadyQueue' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WaitNext' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemAffinityActive' : [ 0x90, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Alertable' : [ 0x90, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'GdiFlushActive' : [ 0x90, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'UserStackWalkActive' : [ 0x90, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Reserved' : [ 0x90, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'KernelStackResident' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessReadyQueue' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WaitNext' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x90, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Alertable' : [ 0x90, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GdiFlushActive' : [ 0x90, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x90, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x90, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x90, ['long']], 'WaitReason' : [ 0x94, ['unsigned char']], 'SwapBusy' : [ 0x95, ['unsigned char']], @@ -1229,16 +1229,16 @@ ntkrnlmp_types = { 'Teb' : [ 0xb0, ['pointer64', ['void']]], 'Timer' : [ 0xb8, ['_KTIMER']], 'TimerFill' : [ 0xb8, ['array', 60, ['unsigned char']]], - 'AutoAlignment' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwStackTraceApc1Inserted' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EtwStackTraceApc2Inserted' : [ 0xf4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CycleChargePending' : [ 0xf4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'CalloutActive' : [ 0xf4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ApcQueueable' : [ 0xf4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'EnableStackSwap' : [ 0xf4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'GuiThread' : [ 0xf4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'ReservedFlags' : [ 0xf4, ['BitField', dict(start_bit = 9, end_bit = 32)]], + 'AutoAlignment' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'EtwStackTraceApc1Inserted' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EtwStackTraceApc2Inserted' : [ 0xf4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CycleChargePending' : [ 0xf4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CalloutActive' : [ 0xf4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ApcQueueable' : [ 0xf4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0xf4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'GuiThread' : [ 0xf4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xf4, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], 'ThreadFlags' : [ 0xf4, ['long']], 'WaitBlock' : [ 0xf8, ['array', 4, ['_KWAIT_BLOCK']]], 'WaitBlockFill0' : [ 0xf8, ['array', 43, ['unsigned char']]], @@ -1331,28 +1331,28 @@ ntkrnlmp_types = { 'OldIrql' : [ 0x30, ['unsigned long']], } ], '__unnamed_1119' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 25)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 64)]], - 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 61)]], - 'Region' : [ 0x8, ['BitField', dict(start_bit = 61, end_bit = 64)]], + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 25, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 61, native_type='unsigned long long')]], + 'Region' : [ 0x8, ['BitField', dict(start_bit = 61, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_111e' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], - 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_1121' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], - 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 4)]], - 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], } ], '_SLIST_HEADER' : [ 0x10, { 'Alignment' : [ 0x0, ['unsigned long long']], @@ -1383,11 +1383,11 @@ ntkrnlmp_types = { 'Information' : [ 0x8, ['unsigned long long']], } ], '_EX_PUSH_LOCK' : [ 0x8, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], 'Ptr' : [ 0x0, ['pointer64', ['void']]], } ], @@ -1420,7 +1420,7 @@ ntkrnlmp_types = { } ], '_EX_FAST_REF' : [ 0x8, { 'Object' : [ 0x0, ['pointer64', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], } ], '_EX_PUSH_LOCK_WAIT_BLOCK' : [ 0x40, { @@ -1464,45 +1464,45 @@ ntkrnlmp_types = { 'ReadClusterSize' : [ 0x410, ['unsigned long']], 'MmLockOrdering' : [ 0x414, ['long']], 'CrossThreadFlags' : [ 0x418, ['unsigned long']], - 'Terminated' : [ 0x418, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ThreadInserted' : [ 0x418, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x418, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x418, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x418, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x418, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x418, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x418, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x418, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyTokenOnOpen' : [ 0x418, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ThreadIoPriority' : [ 0x418, ['BitField', dict(start_bit = 10, end_bit = 13)]], - 'ThreadPagePriority' : [ 0x418, ['BitField', dict(start_bit = 13, end_bit = 16)]], - 'RundownFail' : [ 0x418, ['BitField', dict(start_bit = 16, end_bit = 17)]], + 'Terminated' : [ 0x418, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x418, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x418, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x418, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x418, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x418, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x418, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x418, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x418, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x418, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x418, ['BitField', dict(start_bit = 10, end_bit = 13, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x418, ['BitField', dict(start_bit = 13, end_bit = 16, native_type='unsigned long')]], + 'RundownFail' : [ 0x418, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x41c, ['unsigned long']], - 'ActiveExWorker' : [ 0x41c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x41c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x41c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ClonedThread' : [ 0x41c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'KeyedEventInUse' : [ 0x41c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RateApcState' : [ 0x41c, ['BitField', dict(start_bit = 5, end_bit = 7)]], - 'SelfTerminate' : [ 0x41c, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveExWorker' : [ 0x41c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x41c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x41c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x41c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x41c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RateApcState' : [ 0x41c, ['BitField', dict(start_bit = 5, end_bit = 7, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x41c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x420, ['unsigned long']], - 'Spare' : [ 0x420, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'StartAddressInvalid' : [ 0x420, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwPageFaultCalloutActive' : [ 0x420, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x420, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemWorkingSetShared' : [ 0x420, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x421, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsProcessAddressSpaceExclusive' : [ 0x421, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsProcessAddressSpaceShared' : [ 0x421, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SuppressSymbolLoad' : [ 0x421, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Prefetching' : [ 0x421, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsDynamicMemoryShared' : [ 0x421, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsChangeControlAreaExclusive' : [ 0x421, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsChangeControlAreaShared' : [ 0x421, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Spare1' : [ 0x422, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Spare' : [ 0x420, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x420, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EtwPageFaultCalloutActive' : [ 0x420, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x420, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemWorkingSetShared' : [ 0x420, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x420, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x421, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceExclusive' : [ 0x421, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x421, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x421, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Prefetching' : [ 0x421, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsDynamicMemoryShared' : [ 0x421, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsChangeControlAreaExclusive' : [ 0x421, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsChangeControlAreaShared' : [ 0x421, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare1' : [ 0x422, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], 'PriorityRegionActive' : [ 0x423, ['unsigned char']], 'CacheManagerActive' : [ 0x424, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x425, ['unsigned char']], @@ -1530,7 +1530,7 @@ ntkrnlmp_types = { 'DebugPort' : [ 0x150, ['pointer64', ['void']]], 'ExceptionPortData' : [ 0x158, ['pointer64', ['void']]], 'ExceptionPortValue' : [ 0x158, ['unsigned long long']], - 'ExceptionPortState' : [ 0x158, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'ExceptionPortState' : [ 0x158, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], 'ObjectTable' : [ 0x160, ['pointer64', ['_HANDLE_TABLE']]], 'Token' : [ 0x168, ['_EX_FAST_REF']], 'WorkingSetPage' : [ 0x170, ['unsigned long long']], @@ -1585,55 +1585,55 @@ ntkrnlmp_types = { 'MmProcessLinks' : [ 0x358, ['_LIST_ENTRY']], 'ModifiedPageCount' : [ 0x368, ['unsigned long']], 'Flags2' : [ 0x36c, ['unsigned long']], - 'JobNotReallyActive' : [ 0x36c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AccountingFolded' : [ 0x36c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'NewProcessReported' : [ 0x36c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ExitProcessReported' : [ 0x36c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReportCommitChanges' : [ 0x36c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LastReportMemory' : [ 0x36c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ReportPhysicalPageChanges' : [ 0x36c, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'HandleTableRundown' : [ 0x36c, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'NeedsHandleRundown' : [ 0x36c, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RefTraceEnabled' : [ 0x36c, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'NumaAware' : [ 0x36c, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtectedProcess' : [ 0x36c, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'DefaultPagePriority' : [ 0x36c, ['BitField', dict(start_bit = 12, end_bit = 15)]], - 'PrimaryTokenFrozen' : [ 0x36c, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessVerifierTarget' : [ 0x36c, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'StackRandomizationDisabled' : [ 0x36c, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'AffinityPermanent' : [ 0x36c, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'AffinityUpdateEnable' : [ 0x36c, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'CrossSessionCreate' : [ 0x36c, ['BitField', dict(start_bit = 20, end_bit = 21)]], + 'JobNotReallyActive' : [ 0x36c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x36c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x36c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x36c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x36c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x36c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ReportPhysicalPageChanges' : [ 0x36c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'HandleTableRundown' : [ 0x36c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x36c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x36c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'NumaAware' : [ 0x36c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtectedProcess' : [ 0x36c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x36c, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x36c, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x36c, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x36c, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x36c, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x36c, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x36c, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], 'Flags' : [ 0x370, ['unsigned long']], - 'CreateReported' : [ 0x370, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x370, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x370, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x370, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x370, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x370, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x370, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x370, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x370, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x370, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x370, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x370, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x370, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'DeprioritizeViews' : [ 0x370, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x370, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x370, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x370, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x370, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x370, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x370, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x370, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x370, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x370, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x370, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'SmapAllowed' : [ 0x370, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'ProcessInserted' : [ 0x370, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x370, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'ProcessSelfDelete' : [ 0x370, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'SpareProcessFlags' : [ 0x370, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x370, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x370, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x370, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x370, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x370, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x370, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x370, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x370, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x370, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x370, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x370, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x370, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x370, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x370, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x370, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x370, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x370, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x370, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x370, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x370, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x370, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x370, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x370, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x370, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SmapAllowed' : [ 0x370, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x370, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x370, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x370, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SpareProcessFlags' : [ 0x370, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x374, ['long']], 'Spare7' : [ 0x378, ['unsigned short']], 'SubSystemMinorVersion' : [ 0x37a, ['unsigned char']], @@ -2117,10 +2117,10 @@ ntkrnlmp_types = { 'ThreadListHead' : [ 0x70, ['_LIST_ENTRY']], 'ProcessLock' : [ 0x80, ['unsigned long long']], 'Affinity' : [ 0x88, ['unsigned long long']], - 'AutoAlignment' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ReservedFlags' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'AutoAlignment' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ReservedFlags' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='long')]], 'ProcessFlags' : [ 0x90, ['long']], 'BasePriority' : [ 0x94, ['unsigned char']], 'QuantumReset' : [ 0x95, ['unsigned char']], @@ -2211,12 +2211,12 @@ ntkrnlmp_types = { 'e3' : [ 0x0, ['__unnamed_1420']], } ], '__unnamed_142a' : [ 0x8, { - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 52)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55)]], - 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 52, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57, native_type='unsigned long long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58, native_type='unsigned long long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64, native_type='unsigned long long')]], } ], '_MMPFN' : [ 0x30, { 'u1' : [ 0x0, ['__unnamed_1418']], @@ -2316,10 +2316,10 @@ ntkrnlmp_types = { 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], 'WritableUserReferences' : [ 0x4, ['long']], - 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30)]], - 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30, native_type='unsigned long')]], + 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubsectionRoot' : [ 0x8, ['pointer64', ['_MM_SUBSECTION_AVL_TABLE']]], 'SeImageStub' : [ 0x8, ['pointer64', ['_MI_IMAGE_SECURITY_REFERENCE']]], } ], @@ -2355,11 +2355,11 @@ ntkrnlmp_types = { 'Bitmap' : [ 0x58, ['pointer64', ['_RTL_BITMAP']]], 'BitmapHint' : [ 0x60, ['unsigned long']], 'LastAllocationSize' : [ 0x64, ['unsigned long']], - 'PageFileNumber' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'BootPartition' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Spare0' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 16)]], - 'AdriftMdls' : [ 0x6a, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare1' : [ 0x6a, ['BitField', dict(start_bit = 1, end_bit = 16)]], + 'PageFileNumber' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'BootPartition' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Spare0' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x6a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare1' : [ 0x6a, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], 'FileHandle' : [ 0x70, ['pointer64', ['void']]], 'AvailableList' : [ 0x80, ['_SLIST_HEADER']], 'NeedProcessingList' : [ 0x90, ['_SLIST_HEADER']], @@ -2369,7 +2369,7 @@ ntkrnlmp_types = { 'FreeBit' : [ 0x8, ['unsigned long']], } ], '__unnamed_14ab' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMVAD']]], } ], '__unnamed_14ae' : [ 0x8, { @@ -2392,9 +2392,9 @@ ntkrnlmp_types = { } ], '_MM_AVL_TABLE' : [ 0x40, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'NodeHint' : [ 0x30, ['pointer64', ['void']]], 'NodeFreeHint' : [ 0x38, ['pointer64', ['void']]], } ], @@ -2418,7 +2418,7 @@ ntkrnlmp_types = { 'LastContiguousPte' : [ 0x58, ['pointer64', ['_MMPTE']]], } ], '__unnamed_14cd' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMADDRESS_NODE']]], 'NextToFree' : [ 0x0, ['pointer64', ['_MI_PER_SESSION_PROTOS']]], } ], @@ -2637,19 +2637,19 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0x17e0, ['pointer64', ['void']]], 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'DbgSafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgInDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgHasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgSkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgWerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgRanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DbgSuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RtlDisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 16)]], + 'DbgSafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgInDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgHasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgSkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgWerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgRanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgSuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RtlDisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0x17f0, ['pointer64', ['void']]], 'TxnScopeExitCallback' : [ 0x17f8, ['pointer64', ['void']]], 'TxnScopeContext' : [ 0x1800, ['pointer64', ['void']]], @@ -2709,9 +2709,9 @@ ntkrnlmp_types = { } ], '__unnamed_15c1' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'PStateDomain' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PStateDomainIdleAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'PStateDomain' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'PStateDomainIdleAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], '_PROCESSOR_POWER_STATE' : [ 0x118, { 'IdleStates' : [ 0x0, ['pointer64', ['_PPM_IDLE_STATES']]], @@ -3507,19 +3507,19 @@ ntkrnlmp_types = { 'BufferSequenceNumber' : [ 0x330, ['long long']], 'AcceptNewEvents' : [ 0x338, ['long']], 'Flags' : [ 0x33c, ['unsigned long']], - 'Persistent' : [ 0x33c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoLogger' : [ 0x33c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'FsReady' : [ 0x33c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RealTime' : [ 0x33c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow' : [ 0x33c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelTrace' : [ 0x33c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'NoMoreEnable' : [ 0x33c, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Persistent' : [ 0x33c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x33c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x33c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x33c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x33c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x33c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x33c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], 'RequestFlag' : [ 0x340, ['unsigned long']], - 'RequestNewFie' : [ 0x340, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'RequestUpdateFile' : [ 0x340, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'RequestFlush' : [ 0x340, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RequestDisableRealtime' : [ 0x340, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RequestDisconnectConsumer' : [ 0x340, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'RequestNewFie' : [ 0x340, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RequestUpdateFile' : [ 0x340, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'RequestFlush' : [ 0x340, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RequestDisableRealtime' : [ 0x340, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequestDisconnectConsumer' : [ 0x340, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], 'StackTraceFilterHookCount' : [ 0x344, ['unsigned short']], 'StackTraceFilter' : [ 0x346, ['array', 16, ['unsigned short']]], } ], @@ -3577,8 +3577,8 @@ ntkrnlmp_types = { 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], 'LoggerId' : [ 0x8, ['unsigned short']], 'Level' : [ 0xa, ['unsigned char']], - 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_TRACE_ENABLE_CONTEXT' : [ 0x8, { 'LoggerId' : [ 0x0, ['unsigned short']], @@ -3654,10 +3654,10 @@ ntkrnlmp_types = { 'Object' : [ 0x0, ['pointer64', ['void']]], } ], '__unnamed_1814' : [ 0x1, { - 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], } ], '__unnamed_1816' : [ 0x1, { 's1' : [ 0x0, ['__unnamed_1814']], @@ -3673,8 +3673,8 @@ ntkrnlmp_types = { 'Lock' : [ 0x18, ['_EX_PUSH_LOCK']], } ], '__unnamed_1821' : [ 0x4, { - 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_1823' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1821']], @@ -3691,7 +3691,7 @@ ntkrnlmp_types = { 'RegionListHead' : [ 0x40, ['_LIST_ENTRY']], } ], '__unnamed_1830' : [ 0x4, { - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], } ], '__unnamed_1832' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1830']], @@ -3709,9 +3709,9 @@ ntkrnlmp_types = { 'ViewListHead' : [ 0x50, ['_LIST_ENTRY']], } ], '__unnamed_1838' : [ 0x4, { - 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], } ], '__unnamed_183a' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1838']], @@ -3737,21 +3737,21 @@ ntkrnlmp_types = { 'HandleTable' : [ 0x28, ['_ALPC_HANDLE_TABLE']], } ], '__unnamed_1852' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], } ], '__unnamed_1854' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1852']], @@ -3800,16 +3800,16 @@ ntkrnlmp_types = { 'CallbackId' : [ 0x14, ['unsigned long']], } ], '__unnamed_1870' : [ 0x4, { - 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], } ], '__unnamed_1872' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1870']], @@ -3860,8 +3860,8 @@ ntkrnlmp_types = { 'HandleData' : [ 0x30, ['pointer64', ['_KALPC_HANDLE_DATA']]], } ], '__unnamed_18b1' : [ 0x4, { - 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_18b3' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_18b1']], @@ -3987,18 +3987,18 @@ ntkrnlmp_types = { '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x8, { 'ImpersonationData' : [ 0x0, ['unsigned long long']], 'ImpersonationToken' : [ 0x0, ['pointer64', ['void']]], - 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], } ], '_MMVAD_FLAGS3' : [ 0x8, { - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6)]], - 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24)]], - 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'LargePageCreating' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33)]], - 'Spare3' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64)]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned long long')]], + 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24, native_type='unsigned long long')]], + 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long long')]], + 'LargePageCreating' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'Spare3' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64, native_type='unsigned long long')]], } ], '_MI_VERIFIER_POOL_HEADER' : [ 0x8, { 'VerifierPoolEntry' : [ 0x0, ['pointer64', ['_VI_POOL_ENTRY']]], @@ -4057,22 +4057,22 @@ ntkrnlmp_types = { 'Request' : [ 0x28, ['_PORT_MESSAGE']], } ], '_HARDWARE_PTE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_DUAL' : [ 0x278, { 'Length' : [ 0x0, ['unsigned long']], @@ -4211,7 +4211,7 @@ ntkrnlmp_types = { 'DebugInfo' : [ 0x38, ['pointer64', ['_HANDLE_TRACE_DEBUG_INFO']]], 'ExtraInfoPages' : [ 0x40, ['long']], 'Flags' : [ 0x44, ['unsigned long']], - 'StrictFIFO' : [ 0x44, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x44, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], 'FirstFreeHandle' : [ 0x48, ['long']], 'LastFreeHandleEntry' : [ 0x50, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], 'HandleCount' : [ 0x58, ['long']], @@ -4224,15 +4224,15 @@ ntkrnlmp_types = { 'NumberOfBytes' : [ 0x10, ['unsigned long long']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_VI_CANCEL_GLOBALS' : [ 0x78, { 'CancelLock' : [ 0x0, ['unsigned long long']], @@ -4286,20 +4286,20 @@ ntkrnlmp_types = { 'Reserved4' : [ 0x1a0, ['array', 96, ['unsigned char']]], } ], '_MMPTE_PROTOTYPE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CpuValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CpuValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_THERMAL_INFORMATION_EX' : [ 0x58, { @@ -4316,15 +4316,15 @@ ntkrnlmp_types = { 'S4TransitionTripPoint' : [ 0x54, ['unsigned long']], } ], '__unnamed_19b9' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], } ], '__unnamed_19bb' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], } ], '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { 'File' : [ 0x0, ['__unnamed_19b9']], @@ -4336,14 +4336,14 @@ ntkrnlmp_types = { 'Parameters' : [ 0x10, ['array', 2, ['unsigned long long']]], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16)]], - 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16)]], + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], } ], '_EXCEPTION_POINTERS' : [ 0x10, { 'ExceptionRecord' : [ 0x0, ['pointer64', ['_EXCEPTION_RECORD']]], @@ -4457,9 +4457,9 @@ ntkrnlmp_types = { 'u4' : [ 0x70, ['__unnamed_19f0']], } ], '_MMWSLE_FREE_ENTRY' : [ 0x8, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], - 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_NT_TIB' : [ 0x38, { 'ExceptionList' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], @@ -4517,11 +4517,11 @@ ntkrnlmp_types = { } ], '__unnamed_1a03' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Hypervisor' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Hypervisor' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_IDLE_STATES' : [ 0x48, { 'Type' : [ 0x0, ['unsigned long']], @@ -4538,12 +4538,12 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['pointer64', ['void']]], 'ImageBaseAddress' : [ 0x10, ['pointer64', ['void']]], 'Ldr' : [ 0x18, ['pointer64', ['_PEB_LDR_DATA']]], @@ -4554,11 +4554,11 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x40, ['pointer64', ['void']]], 'IFEOKey' : [ 0x48, ['pointer64', ['void']]], 'CrossProcessFlags' : [ 0x50, ['unsigned long']], - 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x58, ['pointer64', ['void']]], 'UserSharedInfoPtr' : [ 0x58, ['pointer64', ['void']]], 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], @@ -4624,8 +4624,8 @@ ntkrnlmp_types = { 'PcatInformation' : [ 0x0, ['_PCAT_FIRMWARE_INFORMATION']], } ], '_FIRMWARE_INFORMATION_LOADER_BLOCK' : [ 0x20, { - 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'u' : [ 0x8, ['__unnamed_1a1c']], } ], '_HEAP_UCR_DESCRIPTOR' : [ 0x30, { @@ -4681,9 +4681,9 @@ ntkrnlmp_types = { 'PostList' : [ 0x10, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x20, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x28, ['pointer64', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x38, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_KINTERRUPT' : [ 0xa0, { @@ -4829,22 +4829,22 @@ ntkrnlmp_types = { 'Lock' : [ 0x18, ['_EX_PUSH_LOCK']], } ], '_MMPTE_HARDWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x10, { 'Port' : [ 0x0, ['pointer64', ['void']]], @@ -4970,13 +4970,13 @@ ntkrnlmp_types = { 'RmLock' : [ 0x80, ['pointer64', ['_ERESOURCE']]], } ], '_MMVAD_FLAGS' : [ 0x8, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51, native_type='unsigned long long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63, native_type='unsigned long long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_WHEA_PCIXDEVICE_ERROR' : [ 0x68, { 'ValidBits' : [ 0x0, ['_WHEA_PCIXDEVICE_ERROR_VALIDBITS']], @@ -5041,10 +5041,10 @@ ntkrnlmp_types = { } ], '_VF_TRACKER_STAMP' : [ 0x10, { 'Thread' : [ 0x0, ['pointer64', ['void']]], - 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], } ], '_VI_TRACK_IRQL' : [ 0x38, { 'Thread' : [ 0x0, ['pointer64', ['void']]], @@ -5084,11 +5084,11 @@ ntkrnlmp_types = { } ], '_CM_KEY_CONTROL_BLOCK' : [ 0x100, { 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 22)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 22, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x8, ['unsigned long']], 'NextHash' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], @@ -5109,10 +5109,10 @@ ntkrnlmp_types = { 'KcbMaxNameLen' : [ 0x98, ['unsigned short']], 'KcbMaxValueNameLen' : [ 0x9a, ['unsigned short']], 'KcbMaxValueDataLen' : [ 0x9c, ['unsigned long']], - 'KcbUserFlags' : [ 0xa0, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'KcbVirtControlFlags' : [ 0xa0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'KcbDebug' : [ 0xa0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Flags' : [ 0xa0, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'KcbUserFlags' : [ 0xa0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0xa0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0xa0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0xa0, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'RealKeyName' : [ 0xa8, ['pointer64', ['unsigned char']]], 'KCBUoWListHead' : [ 0xb0, ['_LIST_ENTRY']], 'TransKCBOwner' : [ 0xc0, ['pointer64', ['_CM_TRANS']]], @@ -5123,14 +5123,14 @@ ntkrnlmp_types = { 'FullKCBName' : [ 0xf8, ['pointer64', ['_UNICODE_STRING']]], } ], '_MMPTE_SOFTWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_CACHE_UNINITIALIZE_EVENT' : [ 0x20, { 'Next' : [ 0x0, ['pointer64', ['_CACHE_UNINITIALIZE_EVENT']]], @@ -5156,9 +5156,9 @@ ntkrnlmp_types = { } ], '_MM_SUBSECTION_AVL_TABLE' : [ 0x38, { 'BalancedRoot' : [ 0x0, ['_MMSUBSECTION_NODE']], - 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'NodeHint' : [ 0x30, ['pointer64', ['void']]], } ], '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { @@ -5189,17 +5189,17 @@ ntkrnlmp_types = { 'DataValueHigh' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], - 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEGMENT_OBJECT' : [ 0x40, { 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], @@ -5249,22 +5249,22 @@ ntkrnlmp_types = { 'DataLength' : [ 0x10, ['unsigned long']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SessionMaster' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'TrimmerAttached' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'TrimmerDetaching' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 4)]], - 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SessionMaster' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'TrimmerAttached' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'TrimmerDetaching' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], } ], 'PPM_IDLE_ACCOUNTING' : [ 0x48, { 'StateCount' : [ 0x0, ['unsigned long']], @@ -5441,19 +5441,19 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'DbgSafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgInDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgHasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgSkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgWerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgRanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DbgSuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RtlDisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 16)]], + 'DbgSafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgInDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgHasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgSkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgWerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgRanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgSuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RtlDisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], @@ -5542,16 +5542,16 @@ ntkrnlmp_types = { 'List' : [ 0x10, ['_LIST_ENTRY']], } ], '_WHEA_PCIXBUS_ERROR_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BusId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'BusAddress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'BusData' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'BusCommand' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'CompleterId' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'BusId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'BusAddress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'BusData' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'BusCommand' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'CompleterId' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '__unnamed_1b85' : [ 0x8, { @@ -5640,25 +5640,25 @@ ntkrnlmp_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -5770,14 +5770,14 @@ ntkrnlmp_types = { 'Info' : [ 0xd0, ['_THERMAL_INFORMATION_EX']], } ], '_MMPTE_LIST' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_VI_POOL_PAGE_HEADER' : [ 0x18, { 'NextPage' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], @@ -5803,9 +5803,9 @@ ntkrnlmp_types = { 'ByteOffset' : [ 0x2c, ['unsigned long']], } ], '_WHEA_PCIXBUS_COMMAND' : [ 0x8, { - 'Command' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 56)]], - 'PCIXCommand' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 64)]], + 'Command' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 56, native_type='unsigned long long')]], + 'PCIXCommand' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 64, native_type='unsigned long long')]], 'AsULONGLONG' : [ 0x0, ['unsigned long long']], } ], '_CM_TRANS' : [ 0xb0, { @@ -5823,10 +5823,10 @@ ntkrnlmp_types = { 'HiveArray' : [ 0x70, ['array', 8, ['pointer64', ['_CMHIVE']]]], } ], '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { - 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x1c, { @@ -5867,13 +5867,13 @@ ntkrnlmp_types = { 'PolicySetStatus' : [ 0x1b, ['unsigned char']], } ], '_MMPTE_TIMESTAMP' : [ 0x8, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], - 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_SID_AND_ATTRIBUTES_HASH' : [ 0x110, { 'SidCount' : [ 0x0, ['unsigned long']], @@ -5894,10 +5894,10 @@ ntkrnlmp_types = { } ], '__unnamed_1c48' : [ 0x1, { 'AsUCHAR' : [ 0x0, ['unsigned char']], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], } ], 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { 'Revision' : [ 0x0, ['unsigned long']], @@ -5927,29 +5927,29 @@ ntkrnlmp_types = { 'DeviceListHead' : [ 0x8, ['_LIST_ENTRY']], 'Lock' : [ 0x18, ['unsigned long long']], 'Busy' : [ 0x20, ['unsigned char']], - 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='long long')]], + 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='long long')]], } ], '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'ContextAsUlong' : [ 0x0, ['unsigned long']], } ], '_OBJECT_TYPE_INITIALIZER' : [ 0x70, { 'Length' : [ 0x0, ['unsigned short']], 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], - 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], 'ObjectTypeCode' : [ 0x4, ['unsigned long']], 'InvalidAttributes' : [ 0x8, ['unsigned long']], 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], @@ -5999,14 +5999,14 @@ ntkrnlmp_types = { 'ActualLimit' : [ 0x20, ['unsigned long long']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { 'Present' : [ 0x0, ['unsigned long long']], @@ -6014,12 +6014,12 @@ ntkrnlmp_types = { 'EnabledByDefault' : [ 0x10, ['unsigned long long']], } ], '_WHEA_PCIXDEVICE_ERROR_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IdInfo' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryNumber' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IoNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RegisterDataPairs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'IdInfo' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'MemoryNumber' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'IoNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'RegisterDataPairs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], 'WHEA_PCIXDEVICE_REGISTER_PAIR' : [ 0x10, { @@ -6046,14 +6046,14 @@ ntkrnlmp_types = { 'Reserved' : [ 0x14, ['unsigned long']], } ], '_MMWSLENTRY' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], } ], '_DBGKD_SWITCH_PARTITION' : [ 0x4, { 'Partition' : [ 0x0, ['unsigned long']], @@ -6082,14 +6082,14 @@ ntkrnlmp_types = { 'Exchg' : [ 0x0, ['long long']], } ], '_WHEA_TIMESTAMP' : [ 0x8, { - 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40)]], - 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48)]], - 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56)]], - 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64)]], + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], } ], '_PEB32' : [ 0x238, { @@ -6097,12 +6097,12 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['unsigned long']], 'ImageBaseAddress' : [ 0x8, ['unsigned long']], 'Ldr' : [ 0xc, ['unsigned long']], @@ -6113,11 +6113,11 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x20, ['unsigned long']], 'IFEOKey' : [ 0x24, ['unsigned long']], 'CrossProcessFlags' : [ 0x28, ['unsigned long']], - 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x2c, ['unsigned long']], 'UserSharedInfoPtr' : [ 0x2c, ['unsigned long']], 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], @@ -6209,9 +6209,9 @@ ntkrnlmp_types = { 'GenericAll' : [ 0xc, ['unsigned long']], } ], '_KBUGCHECK_ACTIVE_STATE' : [ 0x4, { - 'BugCheckState' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'RecursionCount' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'BugCheckOwner' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'BugCheckState' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'RecursionCount' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'BugCheckOwner' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['long']], } ], '_PF_KERNEL_GLOBALS' : [ 0x60, { @@ -6256,12 +6256,12 @@ ntkrnlmp_types = { 'HandleAttributes' : [ 0x28, ['unsigned long']], } ], '_MMPTE_SUBSECTION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_POWER_STATE' : [ 0x4, { 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], @@ -6364,22 +6364,22 @@ ntkrnlmp_types = { 'ReserveDevice' : [ 0x0, ['pointer64', ['_DEVICE_OBJECT']]], } ], '_MMPTE_HARDWARE_LARGEPAGE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PAT' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 21)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 48)]], - 'reserved2' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PAT' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 21, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 48, native_type='unsigned long long')]], + 'reserved2' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '_KUSER_SHARED_DATA' : [ 0x3b8, { 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], @@ -6415,14 +6415,14 @@ ntkrnlmp_types = { 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], 'SafeBootMode' : [ 0x2ec, ['unsigned char']], 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], - 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], 'SystemCall' : [ 0x300, ['unsigned long']], 'SystemCallReturn' : [ 0x304, ['unsigned long']], @@ -6460,7 +6460,7 @@ ntkrnlmp_types = { 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], } ], '__unnamed_1d29' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMSUBSECTION_NODE']]], } ], '_MMSUBSECTION_NODE' : [ 0x28, { @@ -6502,21 +6502,21 @@ ntkrnlmp_types = { } ], '_WHEA_ERROR_STATUS' : [ 0x8, { 'ErrorStatus' : [ 0x0, ['unsigned long long']], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { - 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], 'AsUCHAR' : [ 0x0, ['unsigned char']], } ], '_FS_FILTER_CALLBACKS' : [ 0x68, { @@ -6672,10 +6672,10 @@ ntkrnlmp_types = { 'BankTemplate' : [ 0x30, ['array', 1, ['_MMPTE']]], } ], '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { - 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_WHEA_PCIEXPRESS_ERROR' : [ 0xd0, { @@ -6707,11 +6707,11 @@ ntkrnlmp_types = { } ], '__unnamed_1da3' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'UsingHypervisor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'UsingHypervisor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_PERF_STATES' : [ 0x98, { 'Count' : [ 0x0, ['unsigned long']], @@ -6816,8 +6816,8 @@ ntkrnlmp_types = { 'Future' : [ 0x58, ['array', 2, ['unsigned long']]], } ], '_WHEA_NMI_ERROR_FLAGS' : [ 0x4, { - 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_M128A' : [ 0x10, { @@ -6914,10 +6914,10 @@ ntkrnlmp_types = { '_IMAGE_SECURITY_CONTEXT' : [ 0x8, { 'PageHashes' : [ 0x0, ['pointer64', ['void']]], 'Value' : [ 0x0, ['unsigned long long']], - 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64)]], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_1dff' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], @@ -6996,8 +6996,8 @@ ntkrnlmp_types = { 'FirmwareDescriptorListHead' : [ 0x68, ['_LIST_ENTRY']], 'AcpiTable' : [ 0x78, ['pointer64', ['void']]], 'AcpiTableSize' : [ 0x80, ['unsigned long']], - 'BootViaWinload' : [ 0x84, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x84, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'BootViaWinload' : [ 0x84, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x84, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'LoaderPerformanceData' : [ 0x88, ['pointer64', ['_LOADER_PERFORMANCE_DATA']]], 'BootApplicationPersistentData' : [ 0x90, ['_LIST_ENTRY']], 'WmdTestResult' : [ 0xa0, ['pointer64', ['void']]], @@ -7036,7 +7036,7 @@ ntkrnlmp_types = { 'Dacl' : [ 0x20, ['pointer64', ['_ACL']]], } ], '__unnamed_1e6d' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x28, { @@ -7102,11 +7102,11 @@ ntkrnlmp_types = { 'PeakNonPagedBytes' : [ 0x98, ['unsigned long long']], } ], '_RTL_SRWLOCK' : [ 0x8, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], 'Ptr' : [ 0x0, ['pointer64', ['void']]], } ], @@ -7203,10 +7203,10 @@ ntkrnlmp_types = { 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], } ], '_POOL_HEADER' : [ 0x10, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'ProcessBilled' : [ 0x8, ['pointer64', ['_EPROCESS']]], @@ -7224,12 +7224,12 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['unsigned long long']], 'ImageBaseAddress' : [ 0x10, ['unsigned long long']], 'Ldr' : [ 0x18, ['unsigned long long']], @@ -7240,11 +7240,11 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x40, ['unsigned long long']], 'IFEOKey' : [ 0x48, ['unsigned long long']], 'CrossProcessFlags' : [ 0x50, ['unsigned long']], - 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x58, ['unsigned long long']], 'UserSharedInfoPtr' : [ 0x58, ['unsigned long long']], 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], @@ -7377,8 +7377,8 @@ ntkrnlmp_types = { } ], '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x10, { 'Process' : [ 0x0, ['pointer64', ['_EPROCESS']]], - 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_CLIENT_ID' : [ 0x10, { 'UniqueProcess' : [ 0x0, ['pointer64', ['void']]], @@ -7386,8 +7386,8 @@ ntkrnlmp_types = { } ], '_VI_DEADLOCK_RESOURCE' : [ 0xf8, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer64', ['void']]], 'ThreadOwner' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x18, ['_LIST_ENTRY']], @@ -7410,33 +7410,33 @@ ntkrnlmp_types = { 'Privilege' : [ 0x8, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], } ], '_SECURITY_CLIENT_CONTEXT' : [ 0x48, { 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], @@ -7619,9 +7619,9 @@ ntkrnlmp_types = { } ], '__unnamed_1f30' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { 'Revision' : [ 0x0, ['unsigned short']], @@ -7707,36 +7707,36 @@ ntkrnlmp_types = { 'DefaultLowLatencyWake' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], } ], '_WHEA_MEMORY_ERROR_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '_WHEA_PCIEXPRESS_DEVICE_ID' : [ 0x10, { 'VendorID' : [ 0x0, ['unsigned short']], 'DeviceID' : [ 0x2, ['unsigned short']], - 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Segment' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 24)]], - 'PrimaryBusNumber' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'SecondaryBusNumber' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 10)]], - 'SlotNumber' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 24)]], - 'Reserved2' : [ 0xc, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Segment' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 24, native_type='unsigned long')]], + 'PrimaryBusNumber' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'SecondaryBusNumber' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 10, native_type='unsigned long')]], + 'SlotNumber' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 24, native_type='unsigned long')]], + 'Reserved2' : [ 0xc, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_WNODE_HEADER' : [ 0x30, { 'BufferSize' : [ 0x0, ['unsigned long']], @@ -7776,12 +7776,12 @@ ntkrnlmp_types = { '_WHEA_PCIXDEVICE_ID' : [ 0x10, { 'VendorId' : [ 0x0, ['unsigned short']], 'DeviceId' : [ 0x2, ['unsigned short']], - 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'BusNumber' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'SegmentNumber' : [ 0x8, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'Reserved1' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'BusNumber' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'SegmentNumber' : [ 0x8, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'Reserved1' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'Reserved2' : [ 0xc, ['unsigned long']], } ], '_PCAT_FIRMWARE_INFORMATION' : [ 0x4, { @@ -7815,10 +7815,10 @@ ntkrnlmp_types = { 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], 'Security' : [ 0x2c, ['unsigned long']], 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'MaxClassLen' : [ 0x38, ['unsigned long']], 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], 'MaxValueDataLen' : [ 0x40, ['unsigned long']], @@ -7845,10 +7845,10 @@ ntkrnlmp_types = { 'Offset' : [ 0x30, ['unsigned long']], 'Length' : [ 0x34, ['unsigned long']], 'Page' : [ 0x38, ['unsigned long long']], - 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'Spare' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Spare' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'CallingAddress' : [ 0x48, ['pointer64', ['void']]], 'CallersCaller' : [ 0x50, ['pointer64', ['void']]], } ], @@ -7939,15 +7939,15 @@ ntkrnlmp_types = { 'BitmapFailures' : [ 0x54, ['unsigned long']], } ], '_WHEA_PCIEXPRESS_ERROR_VALIDBITS' : [ 0x8, { - 'PortType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Version' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CommandStatus' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DeviceId' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DeviceSerialNumber' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'BridgeControlStatus' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ExpressCapability' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'AerInfo' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'PortType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Version' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'CommandStatus' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'DeviceId' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'DeviceSerialNumber' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'BridgeControlStatus' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'ExpressCapability' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'AerInfo' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '_ETW_REG_ENTRY' : [ 0x50, { @@ -8041,18 +8041,18 @@ ntkrnlmp_types = { 'TimeRefreshLockAcquired' : [ 0x2b4, ['unsigned char']], } ], '_SEGMENT_FLAGS' : [ 0x4, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22)]], - 'ContainsPxeSubsection' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22, native_type='unsigned long')]], + 'ContainsPxeSubsection' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_EX_WORK_QUEUE' : [ 0x58, { 'WorkerQueue' : [ 0x0, ['_KQUEUE']], @@ -8148,19 +8148,19 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], - 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0xfca, ['unsigned short']], - 'DbgSafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgInDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgHasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgSkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgWerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgRanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DbgSuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RtlDisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 16)]], + 'DbgSafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgInDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgHasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgSkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgWerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgRanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgSuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RtlDisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], @@ -8198,13 +8198,13 @@ ntkrnlmp_types = { 'StateType' : [ 0x24, ['unsigned char']], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { - 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_KRESOURCEMANAGER' : [ 0x250, { diff --git a/volatility/plugins/overlays/windows/vista_sp2_x86_vtypes.py b/volatility/plugins/overlays/windows/vista_sp2_x86_vtypes.py index cca04ab7..93f0aab8 100644 --- a/volatility/plugins/overlays/windows/vista_sp2_x86_vtypes.py +++ b/volatility/plugins/overlays/windows/vista_sp2_x86_vtypes.py @@ -1,4 +1,4 @@ -nt_types = { +ntkrnlmp_types = { '_KRESOURCEMANAGER_COMPLETION_BINDING' : [ 0x14, { 'NotificationListHead' : [ 0x0, ['_LIST_ENTRY']], 'Port' : [ 0x8, ['pointer', ['void']]], @@ -30,12 +30,12 @@ nt_types = { 'Reserved' : [ 0x2c, ['array', 3, ['unsigned long']]], } ], '_WHEA_PERSISTENCE_INFO' : [ 0x8, { - 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40)]], - 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56)]], - 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58)]], - 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64)]], + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], 'AsULONGLONG' : [ 0x0, ['unsigned long long']], } ], '_MI_SECTION_IMAGE_INFORMATION' : [ 0x38, { @@ -109,11 +109,11 @@ nt_types = { 'Machine' : [ 0x20, ['unsigned short']], 'ImageContainsCode' : [ 0x22, ['unsigned char']], 'ImageFlags' : [ 0x23, ['unsigned char']], - 'ComPlusNativeReady' : [ 0x23, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ComPlusILOnly' : [ 0x23, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ImageDynamicallyRelocated' : [ 0x23, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ImageMappedFlat' : [ 0x23, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x23, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ComPlusNativeReady' : [ 0x23, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x23, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x23, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x23, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x23, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'LoaderFlags' : [ 0x24, ['unsigned long']], 'ImageFileSize' : [ 0x28, ['unsigned long']], 'CheckSum' : [ 0x2c, ['unsigned long']], @@ -267,20 +267,20 @@ nt_types = { 'Dacl' : [ 0x10, ['unsigned long']], } ], '_WHEA_GENERIC_PROCESSOR_ERROR_VALIDBITS' : [ 0x8, { - 'ProcessorType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InstructionSet' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Operation' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Flags' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Level' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CPUVersion' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'CPUBrandString' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ProcessorId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'TargetAddress' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'InstructionPointer' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 64)]], + 'ProcessorType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'InstructionSet' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Operation' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Flags' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Level' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'CPUVersion' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'CPUBrandString' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'ProcessorId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'TargetAddress' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'InstructionPointer' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '__unnamed_2072' : [ 0x10, { @@ -338,10 +338,10 @@ nt_types = { 'ResumeContextPages' : [ 0xec, ['unsigned long']], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'BATTERY_REPORTING_SCALE' : [ 0x8, { @@ -371,13 +371,13 @@ nt_types = { 'HiberFileResumeTime' : [ 0x58, ['unsigned long long']], } ], '_DEVICE_FLAGS' : [ 0x4, { - 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], } ], '_RTL_BALANCED_LINKS' : [ 0x10, { 'Parent' : [ 0x0, ['pointer', ['_RTL_BALANCED_LINKS']]], @@ -388,18 +388,18 @@ nt_types = { } ], '_MMVIEW' : [ 0x8, { 'Entry' : [ 0x0, ['unsigned long']], - 'Writable' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Writable' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], 'ControlArea' : [ 0x4, ['pointer', ['_CONTROL_AREA']]], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_RTL_CRITICAL_SECTION_DEBUG' : [ 0x20, { 'Type' : [ 0x0, ['unsigned short']], @@ -681,8 +681,8 @@ nt_types = { 'QuadPart' : [ 0x0, ['long long']], } ], '__unnamed_1037' : [ 0x4, { - 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Private' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1039' : [ 0x4, { 'Flags' : [ 0x0, ['unsigned long']], @@ -1003,15 +1003,15 @@ nt_types = { 'WaitStatus' : [ 0x60, ['long']], 'WaitBlockList' : [ 0x64, ['pointer', ['_KWAIT_BLOCK']]], 'GateObject' : [ 0x64, ['pointer', ['_KGATE']]], - 'KernelStackResident' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadyTransition' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessReadyQueue' : [ 0x68, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WaitNext' : [ 0x68, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemAffinityActive' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Alertable' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'GdiFlushActive' : [ 0x68, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'UserStackWalkActive' : [ 0x68, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Reserved' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'KernelStackResident' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x68, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessReadyQueue' : [ 0x68, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WaitNext' : [ 0x68, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Alertable' : [ 0x68, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GdiFlushActive' : [ 0x68, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x68, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x68, ['long']], 'WaitReason' : [ 0x6c, ['unsigned char']], 'SwapBusy' : [ 0x6d, ['unsigned char']], @@ -1026,16 +1026,16 @@ nt_types = { 'Teb' : [ 0x84, ['pointer', ['void']]], 'Timer' : [ 0x88, ['_KTIMER']], 'TimerFill' : [ 0x88, ['array', 40, ['unsigned char']]], - 'AutoAlignment' : [ 0xb0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xb0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwStackTraceApc1Inserted' : [ 0xb0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EtwStackTraceApc2Inserted' : [ 0xb0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CycleChargePending' : [ 0xb0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'CalloutActive' : [ 0xb0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ApcQueueable' : [ 0xb0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'EnableStackSwap' : [ 0xb0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'GuiThread' : [ 0xb0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'ReservedFlags' : [ 0xb0, ['BitField', dict(start_bit = 9, end_bit = 32)]], + 'AutoAlignment' : [ 0xb0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0xb0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'EtwStackTraceApc1Inserted' : [ 0xb0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EtwStackTraceApc2Inserted' : [ 0xb0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CycleChargePending' : [ 0xb0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'CalloutActive' : [ 0xb0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ApcQueueable' : [ 0xb0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0xb0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'GuiThread' : [ 0xb0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xb0, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], 'ThreadFlags' : [ 0xb0, ['long']], 'WaitBlock' : [ 0xb8, ['array', 4, ['_KWAIT_BLOCK']]], 'WaitBlockFill0' : [ 0xb8, ['array', 23, ['unsigned char']]], @@ -1131,11 +1131,11 @@ nt_types = { 'Information' : [ 0x4, ['unsigned long']], } ], '_EX_PUSH_LOCK' : [ 0x4, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -1168,7 +1168,7 @@ nt_types = { } ], '_EX_FAST_REF' : [ 0x4, { 'Object' : [ 0x0, ['pointer', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], } ], '_EX_PUSH_LOCK_WAIT_BLOCK' : [ 0x30, { @@ -1212,45 +1212,45 @@ nt_types = { 'ReadClusterSize' : [ 0x258, ['unsigned long']], 'MmLockOrdering' : [ 0x25c, ['long']], 'CrossThreadFlags' : [ 0x260, ['unsigned long']], - 'Terminated' : [ 0x260, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ThreadInserted' : [ 0x260, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x260, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x260, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x260, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x260, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x260, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x260, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x260, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyTokenOnOpen' : [ 0x260, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ThreadIoPriority' : [ 0x260, ['BitField', dict(start_bit = 10, end_bit = 13)]], - 'ThreadPagePriority' : [ 0x260, ['BitField', dict(start_bit = 13, end_bit = 16)]], - 'RundownFail' : [ 0x260, ['BitField', dict(start_bit = 16, end_bit = 17)]], + 'Terminated' : [ 0x260, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x260, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x260, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x260, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x260, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x260, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x260, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x260, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x260, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x260, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x260, ['BitField', dict(start_bit = 10, end_bit = 13, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x260, ['BitField', dict(start_bit = 13, end_bit = 16, native_type='unsigned long')]], + 'RundownFail' : [ 0x260, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x264, ['unsigned long']], - 'ActiveExWorker' : [ 0x264, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x264, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x264, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ClonedThread' : [ 0x264, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'KeyedEventInUse' : [ 0x264, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RateApcState' : [ 0x264, ['BitField', dict(start_bit = 5, end_bit = 7)]], - 'SelfTerminate' : [ 0x264, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveExWorker' : [ 0x264, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x264, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x264, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x264, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x264, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RateApcState' : [ 0x264, ['BitField', dict(start_bit = 5, end_bit = 7, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x264, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x268, ['unsigned long']], - 'Spare' : [ 0x268, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'StartAddressInvalid' : [ 0x268, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwPageFaultCalloutActive' : [ 0x268, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x268, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemWorkingSetShared' : [ 0x268, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x269, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsProcessAddressSpaceExclusive' : [ 0x269, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsProcessAddressSpaceShared' : [ 0x269, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SuppressSymbolLoad' : [ 0x269, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Prefetching' : [ 0x269, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsDynamicMemoryShared' : [ 0x269, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsChangeControlAreaExclusive' : [ 0x269, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsChangeControlAreaShared' : [ 0x269, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Spare1' : [ 0x26a, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Spare' : [ 0x268, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x268, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EtwPageFaultCalloutActive' : [ 0x268, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x268, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemWorkingSetShared' : [ 0x268, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x268, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x269, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceExclusive' : [ 0x269, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x269, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x269, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Prefetching' : [ 0x269, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsDynamicMemoryShared' : [ 0x269, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsChangeControlAreaExclusive' : [ 0x269, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsChangeControlAreaShared' : [ 0x269, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'Spare1' : [ 0x26a, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], 'PriorityRegionActive' : [ 0x26b, ['unsigned char']], 'CacheManagerActive' : [ 0x26c, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x26d, ['unsigned char']], @@ -1278,7 +1278,7 @@ nt_types = { 'DebugPort' : [ 0xd4, ['pointer', ['void']]], 'ExceptionPortData' : [ 0xd8, ['pointer', ['void']]], 'ExceptionPortValue' : [ 0xd8, ['unsigned long']], - 'ExceptionPortState' : [ 0xd8, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'ExceptionPortState' : [ 0xd8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'ObjectTable' : [ 0xdc, ['pointer', ['_HANDLE_TABLE']]], 'Token' : [ 0xe0, ['_EX_FAST_REF']], 'WorkingSetPage' : [ 0xe4, ['unsigned long']], @@ -1333,55 +1333,55 @@ nt_types = { 'MmProcessLinks' : [ 0x218, ['_LIST_ENTRY']], 'ModifiedPageCount' : [ 0x220, ['unsigned long']], 'Flags2' : [ 0x224, ['unsigned long']], - 'JobNotReallyActive' : [ 0x224, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AccountingFolded' : [ 0x224, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'NewProcessReported' : [ 0x224, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ExitProcessReported' : [ 0x224, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReportCommitChanges' : [ 0x224, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LastReportMemory' : [ 0x224, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ReportPhysicalPageChanges' : [ 0x224, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'HandleTableRundown' : [ 0x224, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'NeedsHandleRundown' : [ 0x224, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RefTraceEnabled' : [ 0x224, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'NumaAware' : [ 0x224, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtectedProcess' : [ 0x224, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'DefaultPagePriority' : [ 0x224, ['BitField', dict(start_bit = 12, end_bit = 15)]], - 'PrimaryTokenFrozen' : [ 0x224, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessVerifierTarget' : [ 0x224, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'StackRandomizationDisabled' : [ 0x224, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'AffinityPermanent' : [ 0x224, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'AffinityUpdateEnable' : [ 0x224, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'CrossSessionCreate' : [ 0x224, ['BitField', dict(start_bit = 20, end_bit = 21)]], + 'JobNotReallyActive' : [ 0x224, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x224, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x224, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x224, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x224, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x224, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ReportPhysicalPageChanges' : [ 0x224, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'HandleTableRundown' : [ 0x224, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x224, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x224, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'NumaAware' : [ 0x224, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtectedProcess' : [ 0x224, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x224, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x224, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x224, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x224, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x224, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x224, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x224, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], 'Flags' : [ 0x228, ['unsigned long']], - 'CreateReported' : [ 0x228, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x228, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x228, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x228, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x228, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x228, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x228, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x228, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x228, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x228, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x228, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x228, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x228, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'DeprioritizeViews' : [ 0x228, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x228, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x228, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x228, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x228, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x228, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x228, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x228, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x228, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x228, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x228, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'SmapAllowed' : [ 0x228, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'ProcessInserted' : [ 0x228, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x228, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'ProcessSelfDelete' : [ 0x228, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'SpareProcessFlags' : [ 0x228, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x228, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x228, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x228, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x228, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x228, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x228, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x228, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x228, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x228, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x228, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x228, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x228, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x228, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x228, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x228, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x228, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x228, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x228, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x228, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x228, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x228, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x228, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x228, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x228, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SmapAllowed' : [ 0x228, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x228, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x228, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x228, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SpareProcessFlags' : [ 0x228, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x22c, ['long']], 'Spare7' : [ 0x230, ['unsigned short']], 'SubSystemMinorVersion' : [ 0x232, ['unsigned char']], @@ -1868,10 +1868,10 @@ nt_types = { 'ThreadListHead' : [ 0x50, ['_LIST_ENTRY']], 'ProcessLock' : [ 0x58, ['unsigned long']], 'Affinity' : [ 0x5c, ['unsigned long']], - 'AutoAlignment' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x60, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0x60, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ReservedFlags' : [ 0x60, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'AutoAlignment' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x60, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x60, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ReservedFlags' : [ 0x60, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='long')]], 'ProcessFlags' : [ 0x60, ['long']], 'BasePriority' : [ 0x64, ['unsigned char']], 'QuantumReset' : [ 0x65, ['unsigned char']], @@ -1991,11 +1991,11 @@ nt_types = { 'e3' : [ 0x0, ['__unnamed_142b']], } ], '__unnamed_1432' : [ 0x4, { - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25)]], - 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], } ], '_MMPFN' : [ 0x18, { 'u1' : [ 0x0, ['__unnamed_1424']], @@ -2057,10 +2057,10 @@ nt_types = { 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], 'WritableUserReferences' : [ 0x4, ['long']], - 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30)]], - 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30, native_type='unsigned long')]], + 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubsectionRoot' : [ 0x8, ['pointer', ['_MM_SUBSECTION_AVL_TABLE']]], 'SeImageStub' : [ 0x8, ['pointer', ['_MI_IMAGE_SECURITY_REFERENCE']]], } ], @@ -2096,11 +2096,11 @@ nt_types = { 'Bitmap' : [ 0x2c, ['pointer', ['_RTL_BITMAP']]], 'BitmapHint' : [ 0x30, ['unsigned long']], 'LastAllocationSize' : [ 0x34, ['unsigned long']], - 'PageFileNumber' : [ 0x38, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'BootPartition' : [ 0x38, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Spare0' : [ 0x38, ['BitField', dict(start_bit = 5, end_bit = 16)]], - 'AdriftMdls' : [ 0x3a, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare1' : [ 0x3a, ['BitField', dict(start_bit = 1, end_bit = 16)]], + 'PageFileNumber' : [ 0x38, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'BootPartition' : [ 0x38, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Spare0' : [ 0x38, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x3a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare1' : [ 0x3a, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], 'FileHandle' : [ 0x3c, ['pointer', ['void']]], 'AvailableList' : [ 0x40, ['_SLIST_HEADER']], 'NeedProcessingList' : [ 0x48, ['_SLIST_HEADER']], @@ -2114,7 +2114,7 @@ nt_types = { 'Buffer' : [ 0x4, ['pointer', ['unsigned long']]], } ], '__unnamed_149d' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMVAD']]], } ], '__unnamed_14a0' : [ 0x4, { @@ -2137,9 +2137,9 @@ nt_types = { } ], '_MM_AVL_TABLE' : [ 0x20, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'NodeHint' : [ 0x18, ['pointer', ['void']]], 'NodeFreeHint' : [ 0x1c, ['pointer', ['void']]], } ], @@ -2163,7 +2163,7 @@ nt_types = { 'LastContiguousPte' : [ 0x2c, ['pointer', ['_MMPTE']]], } ], '__unnamed_14be' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMADDRESS_NODE']]], 'NextToFree' : [ 0x0, ['pointer', ['_MI_PER_SESSION_PROTOS']]], } ], @@ -2363,19 +2363,19 @@ nt_types = { 'MergedPrefLanguages' : [ 0xfc0, ['pointer', ['void']]], 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], - 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0xfca, ['unsigned short']], - 'DbgSafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgInDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgHasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgSkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgWerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgRanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DbgSuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RtlDisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 16)]], + 'DbgSafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'DbgInDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DbgHasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'DbgSkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'DbgWerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'DbgRanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'DbgClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'DbgSuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'RtlDisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0xfcc, ['pointer', ['void']]], 'TxnScopeExitCallback' : [ 0xfd0, ['pointer', ['void']]], 'TxnScopeContext' : [ 0xfd4, ['pointer', ['void']]], @@ -2431,9 +2431,9 @@ nt_types = { } ], '__unnamed_15b4' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'PStateDomain' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PStateDomainIdleAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'PStateDomain' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'PStateDomainIdleAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], '_PROCESSOR_POWER_STATE' : [ 0xc8, { 'IdleStates' : [ 0x0, ['pointer', ['_PPM_IDLE_STATES']]], @@ -2479,9 +2479,9 @@ nt_types = { 'PreviousTrapFrame' : [ 0x0, ['pointer', ['_KTRAP_FRAME']]], 'PreviousExceptionList' : [ 0x0, ['pointer', ['void']]], 'StackControlFlags' : [ 0x4, ['unsigned long']], - 'PreviousLargeStack' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousSegmentsPresent' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ExpandCalloutStack' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'PreviousLargeStack' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousSegmentsPresent' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ExpandCalloutStack' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'Previous' : [ 0x8, ['_KERNEL_STACK_SEGMENT']], } ], '_PNP_DEVICE_COMPLETION_QUEUE' : [ 0x2c, { @@ -3152,19 +3152,19 @@ nt_types = { 'BufferSequenceNumber' : [ 0x248, ['long long']], 'AcceptNewEvents' : [ 0x250, ['long']], 'Flags' : [ 0x254, ['unsigned long']], - 'Persistent' : [ 0x254, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoLogger' : [ 0x254, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'FsReady' : [ 0x254, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RealTime' : [ 0x254, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow' : [ 0x254, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelTrace' : [ 0x254, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'NoMoreEnable' : [ 0x254, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Persistent' : [ 0x254, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x254, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x254, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x254, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x254, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x254, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x254, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], 'RequestFlag' : [ 0x258, ['unsigned long']], - 'RequestNewFie' : [ 0x258, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'RequestUpdateFile' : [ 0x258, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'RequestFlush' : [ 0x258, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RequestDisableRealtime' : [ 0x258, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RequestDisconnectConsumer' : [ 0x258, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'RequestNewFie' : [ 0x258, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RequestUpdateFile' : [ 0x258, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'RequestFlush' : [ 0x258, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RequestDisableRealtime' : [ 0x258, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequestDisconnectConsumer' : [ 0x258, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], 'StackTraceFilterHookCount' : [ 0x25c, ['unsigned short']], 'StackTraceFilter' : [ 0x25e, ['array', 16, ['unsigned short']]], } ], @@ -3222,8 +3222,8 @@ nt_types = { 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], 'LoggerId' : [ 0x8, ['unsigned short']], 'Level' : [ 0xa, ['unsigned char']], - 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_TRACE_ENABLE_CONTEXT' : [ 0x8, { 'LoggerId' : [ 0x0, ['unsigned short']], @@ -3299,10 +3299,10 @@ nt_types = { 'Object' : [ 0x0, ['pointer', ['void']]], } ], '__unnamed_180e' : [ 0x1, { - 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], } ], '__unnamed_1810' : [ 0x1, { 's1' : [ 0x0, ['__unnamed_180e']], @@ -3319,8 +3319,8 @@ nt_types = { 'Pad' : [ 0x14, ['unsigned long']], } ], '__unnamed_1818' : [ 0x4, { - 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_181a' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1818']], @@ -3337,7 +3337,7 @@ nt_types = { 'RegionListHead' : [ 0x20, ['_LIST_ENTRY']], } ], '__unnamed_1827' : [ 0x4, { - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], } ], '__unnamed_1829' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1827']], @@ -3355,9 +3355,9 @@ nt_types = { 'ViewListHead' : [ 0x28, ['_LIST_ENTRY']], } ], '__unnamed_182f' : [ 0x4, { - 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], } ], '__unnamed_1831' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_182f']], @@ -3383,21 +3383,21 @@ nt_types = { 'HandleTable' : [ 0x14, ['_ALPC_HANDLE_TABLE']], } ], '__unnamed_1849' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], } ], '__unnamed_184b' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1849']], @@ -3437,16 +3437,16 @@ nt_types = { 'WaitQueueLength' : [ 0xf0, ['unsigned long']], } ], '__unnamed_1862' : [ 0x4, { - 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], } ], '__unnamed_1864' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1862']], @@ -3497,8 +3497,8 @@ nt_types = { 'HandleData' : [ 0x18, ['pointer', ['_KALPC_HANDLE_DATA']]], } ], '__unnamed_18a2' : [ 0x4, { - 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_18a4' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_18a2']], @@ -3623,16 +3623,16 @@ nt_types = { '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x4, { 'ImpersonationData' : [ 0x0, ['unsigned long']], 'ImpersonationToken' : [ 0x0, ['pointer', ['void']]], - 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], } ], '_MMVAD_FLAGS3' : [ 0x4, { - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6)]], - 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24)]], - 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned long')]], + 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24, native_type='unsigned long')]], + 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_MI_VERIFIER_POOL_HEADER' : [ 0x4, { 'VerifierPoolEntry' : [ 0x0, ['pointer', ['_VI_POOL_ENTRY']]], @@ -3690,19 +3690,19 @@ nt_types = { 'Request' : [ 0x18, ['_PORT_MESSAGE']], } ], '_HARDWARE_PTE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_DUAL' : [ 0x13c, { 'Length' : [ 0x0, ['unsigned long']], @@ -3737,8 +3737,8 @@ nt_types = { 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], 'FileOffset' : [ 0x0, ['unsigned long long']], 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], - 'DontUse0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'DontUse0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'PointerProtoPte' : [ 0x4, ['pointer', ['void']]], } ], '_HEAP_COUNTERS' : [ 0x48, { @@ -3833,7 +3833,7 @@ nt_types = { 'DebugInfo' : [ 0x1c, ['pointer', ['_HANDLE_TRACE_DEBUG_INFO']]], 'ExtraInfoPages' : [ 0x20, ['long']], 'Flags' : [ 0x24, ['unsigned long']], - 'StrictFIFO' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], 'FirstFreeHandle' : [ 0x28, ['long']], 'LastFreeHandleEntry' : [ 0x2c, ['pointer', ['_HANDLE_TABLE_ENTRY']]], 'HandleCount' : [ 0x30, ['long']], @@ -3846,15 +3846,15 @@ nt_types = { 'NumberOfBytes' : [ 0xc, ['unsigned long']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_VI_CANCEL_GLOBALS' : [ 0x6c, { 'CancelLock' : [ 0x0, ['unsigned long']], @@ -3890,18 +3890,18 @@ nt_types = { 'ContextListHead' : [ 0x24, ['_LIST_ENTRY']], } ], '_MMPTE_PROTOTYPE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 9)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 9, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CpuValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CpuValid' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_THERMAL_INFORMATION_EX' : [ 0x50, { @@ -3918,15 +3918,15 @@ nt_types = { 'S4TransitionTripPoint' : [ 0x4c, ['unsigned long']], } ], '__unnamed_1991' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], } ], '__unnamed_1993' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], } ], '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { 'File' : [ 0x0, ['__unnamed_1991']], @@ -3938,14 +3938,14 @@ nt_types = { 'Parameters' : [ 0x8, ['array', 2, ['unsigned long']]], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16)]], - 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16)]], + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], } ], '_EXCEPTION_POINTERS' : [ 0x8, { 'ExceptionRecord' : [ 0x0, ['pointer', ['_EXCEPTION_RECORD']]], @@ -4059,9 +4059,9 @@ nt_types = { 'u4' : [ 0x38, ['__unnamed_19c8']], } ], '_MMWSLE_FREE_ENTRY' : [ 0x4, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 12)]], - 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 12, native_type='unsigned long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_NT_TIB' : [ 0x1c, { 'ExceptionList' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], @@ -4119,11 +4119,11 @@ nt_types = { } ], '__unnamed_19d8' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Hypervisor' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Hypervisor' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_IDLE_STATES' : [ 0x3c, { 'Type' : [ 0x0, ['unsigned long']], @@ -4140,12 +4140,12 @@ nt_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['pointer', ['void']]], 'ImageBaseAddress' : [ 0x8, ['pointer', ['void']]], 'Ldr' : [ 0xc, ['pointer', ['_PEB_LDR_DATA']]], @@ -4156,11 +4156,11 @@ nt_types = { 'AtlThunkSListPtr' : [ 0x20, ['pointer', ['void']]], 'IFEOKey' : [ 0x24, ['pointer', ['void']]], 'CrossProcessFlags' : [ 0x28, ['unsigned long']], - 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x2c, ['pointer', ['void']]], 'UserSharedInfoPtr' : [ 0x2c, ['pointer', ['void']]], 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], @@ -4226,8 +4226,8 @@ nt_types = { 'PcatInformation' : [ 0x0, ['_PCAT_FIRMWARE_INFORMATION']], } ], '_FIRMWARE_INFORMATION_LOADER_BLOCK' : [ 0x14, { - 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'u' : [ 0x4, ['__unnamed_19f0']], } ], '_HEAP_UCR_DESCRIPTOR' : [ 0x18, { @@ -4243,16 +4243,16 @@ nt_types = { 'BaseHi' : [ 0x3, ['unsigned char']], } ], '__unnamed_19fd' : [ 0x4, { - 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_19ff' : [ 0x4, { 'Bytes' : [ 0x0, ['__unnamed_19f7']], @@ -4310,9 +4310,9 @@ nt_types = { 'PostList' : [ 0x8, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x10, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x14, ['pointer', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_KINTERRUPT' : [ 0x270, { @@ -4417,19 +4417,19 @@ nt_types = { 'Lock' : [ 0xc, ['_EX_PUSH_LOCK']], } ], '_MMPTE_HARDWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x8, { 'Port' : [ 0x0, ['pointer', ['void']]], @@ -4555,13 +4555,13 @@ nt_types = { 'RmLock' : [ 0x50, ['pointer', ['_ERESOURCE']]], } ], '_MMVAD_FLAGS' : [ 0x4, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_WHEA_PCIXDEVICE_ERROR' : [ 0x68, { 'ValidBits' : [ 0x0, ['_WHEA_PCIXDEVICE_ERROR_VALIDBITS']], @@ -4619,10 +4619,10 @@ nt_types = { } ], '_VF_TRACKER_STAMP' : [ 0x8, { 'Thread' : [ 0x0, ['pointer', ['void']]], - 'Flags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'OldIrql' : [ 0x5, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'NewIrql' : [ 0x6, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Processor' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Flags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x5, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0x6, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], } ], '_VI_TRACK_IRQL' : [ 0x20, { 'Thread' : [ 0x0, ['pointer', ['void']]], @@ -4662,11 +4662,11 @@ nt_types = { } ], '_CM_KEY_CONTROL_BLOCK' : [ 0x90, { 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 22)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 22, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x8, ['unsigned long']], 'NextHash' : [ 0xc, ['pointer', ['_CM_KEY_HASH']]], @@ -4687,10 +4687,10 @@ nt_types = { 'KcbMaxNameLen' : [ 0x58, ['unsigned short']], 'KcbMaxValueNameLen' : [ 0x5a, ['unsigned short']], 'KcbMaxValueDataLen' : [ 0x5c, ['unsigned long']], - 'KcbUserFlags' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'KcbVirtControlFlags' : [ 0x60, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'KcbDebug' : [ 0x60, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Flags' : [ 0x60, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'KcbUserFlags' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0x60, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0x60, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0x60, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'KCBUoWListHead' : [ 0x64, ['_LIST_ENTRY']], 'TransKCBOwner' : [ 0x6c, ['pointer', ['_CM_TRANS']]], 'KCBLock' : [ 0x70, ['_CM_INTENT_LOCK']], @@ -4700,12 +4700,12 @@ nt_types = { 'FullKCBName' : [ 0x8c, ['pointer', ['_UNICODE_STRING']]], } ], '_MMPTE_SOFTWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_CACHE_UNINITIALIZE_EVENT' : [ 0x14, { 'Next' : [ 0x0, ['pointer', ['_CACHE_UNINITIALIZE_EVENT']]], @@ -4731,9 +4731,9 @@ nt_types = { } ], '_MM_SUBSECTION_AVL_TABLE' : [ 0x20, { 'BalancedRoot' : [ 0x0, ['_MMSUBSECTION_NODE']], - 'DepthOfTree' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x18, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DepthOfTree' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x18, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'NodeHint' : [ 0x1c, ['pointer', ['void']]], } ], '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { @@ -4764,17 +4764,17 @@ nt_types = { 'DataValueHigh' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], - 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEGMENT_OBJECT' : [ 0x28, { 'BaseAddress' : [ 0x0, ['pointer', ['void']]], @@ -4867,22 +4867,22 @@ nt_types = { 'DataLength' : [ 0x8, ['unsigned long']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SessionMaster' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'TrimmerAttached' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'TrimmerDetaching' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 4)]], - 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SessionMaster' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'TrimmerAttached' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'TrimmerDetaching' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], } ], 'PPM_IDLE_ACCOUNTING' : [ 0x48, { 'StateCount' : [ 0x0, ['unsigned long']], @@ -5064,16 +5064,16 @@ nt_types = { 'List' : [ 0x8, ['_LIST_ENTRY']], } ], '_WHEA_PCIXBUS_ERROR_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BusId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'BusAddress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'BusData' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'BusCommand' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'CompleterId' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'BusId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'BusAddress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'BusData' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'BusCommand' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'CompleterId' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '__unnamed_1b64' : [ 0x4, { @@ -5172,25 +5172,25 @@ nt_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -5302,12 +5302,12 @@ nt_types = { 'Info' : [ 0x84, ['_THERMAL_INFORMATION_EX']], } ], '_MMPTE_LIST' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_VI_POOL_PAGE_HEADER' : [ 0xc, { 'NextPage' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], @@ -5333,9 +5333,9 @@ nt_types = { 'ByteOffset' : [ 0x18, ['unsigned long']], } ], '_WHEA_PCIXBUS_COMMAND' : [ 0x8, { - 'Command' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 56)]], - 'PCIXCommand' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 64)]], + 'Command' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 56, native_type='unsigned long long')]], + 'PCIXCommand' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 64, native_type='unsigned long long')]], 'AsULONGLONG' : [ 0x0, ['unsigned long long']], } ], '_CM_TRANS' : [ 0x68, { @@ -5353,10 +5353,10 @@ nt_types = { 'HiveArray' : [ 0x48, ['array', 8, ['pointer', ['_CMHIVE']]]], } ], '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { - 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x18, { @@ -5420,12 +5420,12 @@ nt_types = { 'PolicySetStatus' : [ 0x1b, ['unsigned char']], } ], '_MMPTE_TIMESTAMP' : [ 0x4, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_SID_AND_ATTRIBUTES_HASH' : [ 0x88, { 'SidCount' : [ 0x0, ['unsigned long']], @@ -5446,10 +5446,10 @@ nt_types = { } ], '__unnamed_1c2b' : [ 0x1, { 'AsUCHAR' : [ 0x0, ['unsigned char']], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], } ], 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { 'Revision' : [ 0x0, ['unsigned long']], @@ -5481,25 +5481,25 @@ nt_types = { 'Busy' : [ 0x10, ['unsigned char']], } ], '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'ContextAsUlong' : [ 0x0, ['unsigned long']], } ], '_OBJECT_TYPE_INITIALIZER' : [ 0x50, { 'Length' : [ 0x0, ['unsigned short']], 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], - 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], 'ObjectTypeCode' : [ 0x4, ['unsigned long']], 'InvalidAttributes' : [ 0x8, ['unsigned long']], 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], @@ -5545,14 +5545,14 @@ nt_types = { 'ActualLimit' : [ 0x10, ['unsigned long']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { 'Present' : [ 0x0, ['unsigned long long']], @@ -5560,12 +5560,12 @@ nt_types = { 'EnabledByDefault' : [ 0x10, ['unsigned long long']], } ], '_WHEA_PCIXDEVICE_ERROR_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IdInfo' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryNumber' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IoNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RegisterDataPairs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'IdInfo' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'MemoryNumber' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'IoNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'RegisterDataPairs' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], 'WHEA_PCIXDEVICE_REGISTER_PAIR' : [ 0x10, { @@ -5592,14 +5592,14 @@ nt_types = { 'Reserved' : [ 0xc, ['unsigned long']], } ], '_MMWSLENTRY' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_DBGKD_SWITCH_PARTITION' : [ 0x4, { 'Partition' : [ 0x0, ['unsigned long']], @@ -5628,14 +5628,14 @@ nt_types = { 'Exchg' : [ 0x0, ['long long']], } ], '_WHEA_TIMESTAMP' : [ 0x8, { - 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40)]], - 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48)]], - 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56)]], - 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64)]], + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], } ], '_VPB' : [ 0x58, { @@ -5714,10 +5714,10 @@ nt_types = { 'HandleAttributes' : [ 0x18, ['unsigned long']], } ], '_MMPTE_SUBSECTION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_POWER_STATE' : [ 0x4, { 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], @@ -5853,14 +5853,14 @@ nt_types = { 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], 'SafeBootMode' : [ 0x2ec, ['unsigned char']], 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], - 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], 'SystemCall' : [ 0x300, ['unsigned long']], 'SystemCallReturn' : [ 0x304, ['unsigned long']], @@ -5898,7 +5898,7 @@ nt_types = { 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], } ], '__unnamed_1cf7' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMSUBSECTION_NODE']]], } ], '_MMSUBSECTION_NODE' : [ 0x18, { @@ -5940,21 +5940,21 @@ nt_types = { } ], '_WHEA_ERROR_STATUS' : [ 0x8, { 'ErrorStatus' : [ 0x0, ['unsigned long long']], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { - 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], 'AsUCHAR' : [ 0x0, ['unsigned char']], } ], '_FS_FILTER_CALLBACKS' : [ 0x38, { @@ -6110,10 +6110,10 @@ nt_types = { 'BankTemplate' : [ 0x1c, ['array', 1, ['_MMPTE']]], } ], '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { - 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_WHEA_PCIEXPRESS_ERROR' : [ 0xd0, { @@ -6184,11 +6184,11 @@ nt_types = { } ], '__unnamed_1d74' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'UsingHypervisor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'UsingHypervisor' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_PERF_STATES' : [ 0x78, { 'Count' : [ 0x0, ['unsigned long']], @@ -6288,8 +6288,8 @@ nt_types = { 'Future' : [ 0x40, ['array', 2, ['unsigned long']]], } ], '_WHEA_NMI_ERROR_FLAGS' : [ 0x4, { - 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_HEAP_LOOKASIDE' : [ 0x30, { @@ -6382,10 +6382,10 @@ nt_types = { '_IMAGE_SECURITY_CONTEXT' : [ 0x4, { 'PageHashes' : [ 0x0, ['pointer', ['void']]], 'Value' : [ 0x0, ['unsigned long']], - 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1dc7' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], @@ -6466,8 +6466,8 @@ nt_types = { 'FirmwareDescriptorListHead' : [ 0x48, ['_LIST_ENTRY']], 'AcpiTable' : [ 0x50, ['pointer', ['void']]], 'AcpiTableSize' : [ 0x54, ['unsigned long']], - 'BootViaWinload' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'BootViaWinload' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'LoaderPerformanceData' : [ 0x5c, ['pointer', ['_LOADER_PERFORMANCE_DATA']]], 'BootApplicationPersistentData' : [ 0x60, ['_LIST_ENTRY']], 'WmdTestResult' : [ 0x68, ['pointer', ['void']]], @@ -6506,7 +6506,7 @@ nt_types = { 'Dacl' : [ 0x10, ['pointer', ['_ACL']]], } ], '__unnamed_1e33' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x14, { @@ -6572,11 +6572,11 @@ nt_types = { 'PeakNonPagedBytes' : [ 0x54, ['unsigned long']], } ], '_RTL_SRWLOCK' : [ 0x4, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -6644,10 +6644,10 @@ nt_types = { 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], } ], '_POOL_HEADER' : [ 0x8, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16)]], - 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'AllocatorBackTraceIndex' : [ 0x4, ['unsigned short']], @@ -6728,8 +6728,8 @@ nt_types = { } ], '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x8, { 'Process' : [ 0x0, ['pointer', ['_EPROCESS']]], - 'HandleCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'LockCount' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'HandleCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_CLIENT_ID' : [ 0x8, { 'UniqueProcess' : [ 0x0, ['pointer', ['void']]], @@ -6737,8 +6737,8 @@ nt_types = { } ], '_VI_DEADLOCK_RESOURCE' : [ 0x80, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer', ['void']]], 'ThreadOwner' : [ 0xc, ['pointer', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x10, ['_LIST_ENTRY']], @@ -6761,33 +6761,33 @@ nt_types = { 'Privilege' : [ 0x8, ['array', 1, ['_LUID_AND_ATTRIBUTES']]], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], } ], '_SECURITY_CLIENT_CONTEXT' : [ 0x3c, { 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], @@ -6966,9 +6966,9 @@ nt_types = { } ], '__unnamed_1eed' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { 'Revision' : [ 0x0, ['unsigned short']], @@ -7054,36 +7054,36 @@ nt_types = { 'DefaultLowLatencyWake' : [ 0x48, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], } ], '_WHEA_MEMORY_ERROR_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '_WHEA_PCIEXPRESS_DEVICE_ID' : [ 0x10, { 'VendorID' : [ 0x0, ['unsigned short']], 'DeviceID' : [ 0x2, ['unsigned short']], - 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Segment' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 24)]], - 'PrimaryBusNumber' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'SecondaryBusNumber' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 10)]], - 'SlotNumber' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 24)]], - 'Reserved2' : [ 0xc, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Segment' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 24, native_type='unsigned long')]], + 'PrimaryBusNumber' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'SecondaryBusNumber' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Reserved1' : [ 0xc, ['BitField', dict(start_bit = 8, end_bit = 10, native_type='unsigned long')]], + 'SlotNumber' : [ 0xc, ['BitField', dict(start_bit = 10, end_bit = 24, native_type='unsigned long')]], + 'Reserved2' : [ 0xc, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_WNODE_HEADER' : [ 0x30, { 'BufferSize' : [ 0x0, ['unsigned long']], @@ -7123,12 +7123,12 @@ nt_types = { '_WHEA_PCIXDEVICE_ID' : [ 0x10, { 'VendorId' : [ 0x0, ['unsigned short']], 'DeviceId' : [ 0x2, ['unsigned short']], - 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'BusNumber' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'SegmentNumber' : [ 0x8, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'Reserved1' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'ClassCode' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], + 'DeviceNumber' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'BusNumber' : [ 0x8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'SegmentNumber' : [ 0x8, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'Reserved1' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'Reserved2' : [ 0xc, ['unsigned long']], } ], '_PCAT_FIRMWARE_INFORMATION' : [ 0x4, { @@ -7162,10 +7162,10 @@ nt_types = { 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], 'Security' : [ 0x2c, ['unsigned long']], 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'MaxClassLen' : [ 0x38, ['unsigned long']], 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], 'MaxValueDataLen' : [ 0x40, ['unsigned long']], @@ -7192,10 +7192,10 @@ nt_types = { 'Offset' : [ 0x18, ['unsigned long']], 'Length' : [ 0x1c, ['unsigned long']], 'Page' : [ 0x20, ['unsigned long']], - 'IoMapping' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Matched' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CacheAttribute' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'Spare' : [ 0x24, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'IoMapping' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Spare' : [ 0x24, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'CallingAddress' : [ 0x28, ['pointer', ['void']]], 'CallersCaller' : [ 0x2c, ['pointer', ['void']]], } ], @@ -7282,15 +7282,15 @@ nt_types = { 'BitmapFailures' : [ 0x34, ['unsigned long']], } ], '_WHEA_PCIEXPRESS_ERROR_VALIDBITS' : [ 0x8, { - 'PortType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Version' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CommandStatus' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DeviceId' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DeviceSerialNumber' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'BridgeControlStatus' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ExpressCapability' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'AerInfo' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'PortType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Version' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'CommandStatus' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'DeviceId' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'DeviceSerialNumber' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'BridgeControlStatus' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'ExpressCapability' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'AerInfo' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '_ETW_REG_ENTRY' : [ 0x2c, { @@ -7382,18 +7382,18 @@ nt_types = { 'TimeRefreshLockAcquired' : [ 0x184, ['unsigned char']], } ], '_SEGMENT_FLAGS' : [ 0x4, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22)]], - 'ContainsPxeSubsection' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22, native_type='unsigned long')]], + 'ContainsPxeSubsection' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_EX_WORK_QUEUE' : [ 0x3c, { 'WorkerQueue' : [ 0x0, ['_KQUEUE']], @@ -7435,13 +7435,13 @@ nt_types = { 'StateType' : [ 0x1c, ['unsigned char']], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { - 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_KRESOURCEMANAGER' : [ 0x154, { @@ -7609,9 +7609,9 @@ nt_types = { '_VF_BTS_RECORD' : [ 0xc, { 'JumpedFrom' : [ 0x0, ['pointer', ['void']]], 'JumpedTo' : [ 0x4, ['pointer', ['void']]], - 'Unused1' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Predicted' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 7)]], - 'Unused2' : [ 0x8, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Unused1' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Predicted' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'Unused2' : [ 0x8, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_KTRANSACTION' : [ 0x1e0, { 'OutcomeEvent' : [ 0x0, ['_KEVENT']], @@ -7657,11 +7657,11 @@ nt_types = { 'PromotionCompletedEvent' : [ 0x1cc, ['_KEVENT']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], } ], '_CM_KCB_UOW' : [ 0x38, { 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -7690,24 +7690,24 @@ nt_types = { 'SpecialRegisters' : [ 0x2cc, ['_KSPECIAL_REGISTERS']], } ], '_MMPTE_TRANSITION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '__unnamed_1fd5' : [ 0x8, { - 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48)]], - 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_1fd7' : [ 0x8, { 's1' : [ 0x0, ['__unnamed_1fd5']], @@ -7731,19 +7731,19 @@ nt_types = { 'Name' : [ 0xa, ['array', 1, ['wchar']]], } ], '_MMSECURE_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12, native_type='unsigned long')]], } ], '_PO_IRP_QUEUE' : [ 0x8, { 'CurrentIrp' : [ 0x0, ['pointer', ['_IRP']]], 'PendingIrpList' : [ 0x4, ['pointer', ['_IRP']]], } ], '__unnamed_1fe9' : [ 0x4, { - 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'Whole' : [ 0x0, ['unsigned long']], } ], '_VI_DEADLOCK_NODE' : [ 0x6c, { diff --git a/volatility/plugins/overlays/windows/win2003_sp0_x86_vtypes.py b/volatility/plugins/overlays/windows/win2003_sp0_x86_vtypes.py index d618e808..fa096ad2 100644 --- a/volatility/plugins/overlays/windows/win2003_sp0_x86_vtypes.py +++ b/volatility/plugins/overlays/windows/win2003_sp0_x86_vtypes.py @@ -1,4 +1,4 @@ -nt_types = { +ntkrnlmp_types = { 'LIST_ENTRY64' : [ 0x10, { 'Flink' : [ 0x0, ['unsigned long long']], 'Blink' : [ 0x8, ['unsigned long long']], @@ -333,13 +333,13 @@ nt_types = { } ], '_EX_FAST_REF' : [ 0x4, { 'Object' : [ 0x0, ['pointer', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], } ], '_EX_PUSH_LOCK' : [ 0x4, { - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Exclusive' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Exclusive' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -351,14 +351,14 @@ nt_types = { 'ShareCount' : [ 0x1c, ['unsigned long']], 'Exclusive' : [ 0x20, ['unsigned char']], } ], - '_EX_PUSH_LOCK_CACHE_AWARE' : [ 0x4, { - 'Locks' : [ 0x0, ['array', 1, ['pointer', ['_EX_PUSH_LOCK']]]], + '_EX_PUSH_LOCK_CACHE_AWARE' : [ 0x80, { + 'Locks' : [ 0x0, ['array', 32, ['pointer', ['_EX_PUSH_LOCK']]]], } ], '_ETHREAD' : [ 0x260, { 'Tcb' : [ 0x0, ['_KTHREAD']], 'CreateTime' : [ 0x1c8, ['_LARGE_INTEGER']], - 'NestedFaultCount' : [ 0x1c8, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'ApcNeeded' : [ 0x1c8, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'NestedFaultCount' : [ 0x1c8, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'ApcNeeded' : [ 0x1c8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'ExitTime' : [ 0x1d0, ['_LARGE_INTEGER']], 'LpcReplyChain' : [ 0x1d0, ['_LIST_ENTRY']], 'KeyedWaitChain' : [ 0x1d0, ['_LIST_ENTRY']], @@ -390,24 +390,24 @@ nt_types = { 'ReadClusterSize' : [ 0x248, ['unsigned long']], 'GrantedAccess' : [ 0x24c, ['unsigned long']], 'CrossThreadFlags' : [ 0x250, ['unsigned long']], - 'Terminated' : [ 0x250, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeadThread' : [ 0x250, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x250, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x250, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x250, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x250, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x250, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x250, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x250, ['BitField', dict(start_bit = 8, end_bit = 9)]], + 'Terminated' : [ 0x250, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeadThread' : [ 0x250, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x250, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x250, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x250, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x250, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x250, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x250, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x250, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x254, ['unsigned long']], - 'ActiveExWorker' : [ 0x254, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x254, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x254, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'KeyedEventInUse' : [ 0x254, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'ActiveExWorker' : [ 0x254, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x254, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x254, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x254, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x258, ['unsigned long']], - 'LpcReceivedMsgIdValid' : [ 0x258, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LpcExitThreadCalled' : [ 0x258, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'AddressSpaceOwner' : [ 0x258, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'LpcReceivedMsgIdValid' : [ 0x258, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'LpcExitThreadCalled' : [ 0x258, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'AddressSpaceOwner' : [ 0x258, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], 'ForwardClusterOnly' : [ 0x25c, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x25d, ['unsigned char']], } ], @@ -481,31 +481,31 @@ nt_types = { 'ModifiedPageCount' : [ 0x240, ['unsigned long']], 'JobStatus' : [ 0x244, ['unsigned long']], 'Flags' : [ 0x248, ['unsigned long']], - 'CreateReported' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x248, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x248, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x248, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x248, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x248, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'SessionCreationUnderway' : [ 0x248, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x248, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x248, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x248, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x248, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x248, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x248, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x248, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x248, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x248, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x248, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'Unused' : [ 0x248, ['BitField', dict(start_bit = 25, end_bit = 32)]], + 'CreateReported' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x248, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x248, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x248, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x248, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x248, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'SessionCreationUnderway' : [ 0x248, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x248, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x248, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x248, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x248, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x248, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x248, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x248, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x248, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x248, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x248, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'Unused' : [ 0x248, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x24c, ['long']], 'NextPageColor' : [ 0x250, ['unsigned short']], 'SubSystemMinorVersion' : [ 0x252, ['unsigned char']], @@ -611,54 +611,54 @@ nt_types = { '_KEVENT' : [ 0x10, { 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], } ], - '__unnamed_1126' : [ 0x208, { + '__unnamed_1128' : [ 0x208, { 'FnArea' : [ 0x0, ['_FNSAVE_FORMAT']], 'FxArea' : [ 0x0, ['_FXSAVE_FORMAT']], } ], '_FX_SAVE_AREA' : [ 0x210, { - 'U' : [ 0x0, ['__unnamed_1126']], + 'U' : [ 0x0, ['__unnamed_1128']], 'NpxSavedCpu' : [ 0x208, ['unsigned long']], 'Cr0NpxState' : [ 0x20c, ['unsigned long']], } ], - '__unnamed_1130' : [ 0x4, { + '__unnamed_1132' : [ 0x4, { 'Flink' : [ 0x0, ['unsigned long']], 'WsIndex' : [ 0x0, ['unsigned long']], 'Event' : [ 0x0, ['pointer', ['_KEVENT']]], 'ReadStatus' : [ 0x0, ['long']], 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], } ], - '__unnamed_1134' : [ 0x4, { + '__unnamed_1136' : [ 0x4, { 'Blink' : [ 0x0, ['unsigned long']], 'ShareCount' : [ 0x0, ['unsigned long']], } ], - '__unnamed_1137' : [ 0x4, { + '__unnamed_1139' : [ 0x4, { 'ShortFlags' : [ 0x0, ['unsigned short']], 'ReferenceCount' : [ 0x2, ['unsigned short']], } ], - '__unnamed_1139' : [ 0x4, { + '__unnamed_113b' : [ 0x4, { 'e1' : [ 0x0, ['_MMPFNENTRY']], - 'e2' : [ 0x0, ['__unnamed_1137']], + 'e2' : [ 0x0, ['__unnamed_1139']], } ], - '__unnamed_1142' : [ 0x4, { + '__unnamed_1144' : [ 0x4, { 'EntireFrame' : [ 0x0, ['unsigned long']], - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 26)]], - 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'LockCharged' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'KernelStack' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'MustBeCached' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 26, native_type='unsigned long')]], + 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'LockCharged' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'KernelStack' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'MustBeCached' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_MMPFN' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_1130']], + 'u1' : [ 0x0, ['__unnamed_1132']], 'PteAddress' : [ 0x4, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x8, ['__unnamed_1134']], - 'u3' : [ 0xc, ['__unnamed_1139']], + 'u2' : [ 0x8, ['__unnamed_1136']], + 'u3' : [ 0xc, ['__unnamed_113b']], 'OriginalPte' : [ 0x10, ['_MMPTE']], 'AweReferenceCount' : [ 0x10, ['long']], - 'u4' : [ 0x14, ['__unnamed_1142']], + 'u4' : [ 0x14, ['__unnamed_1144']], } ], - '__unnamed_114c' : [ 0x4, { + '__unnamed_114e' : [ 0x4, { 'Long' : [ 0x0, ['unsigned long']], 'Flush' : [ 0x0, ['_HARDWARE_PTE']], 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], @@ -669,7 +669,7 @@ nt_types = { 'List' : [ 0x0, ['_MMPTE_LIST']], } ], '_MMPTE' : [ 0x4, { - 'u' : [ 0x0, ['__unnamed_114c']], + 'u' : [ 0x0, ['__unnamed_114e']], } ], '_MMPAGING_FILE' : [ 0x3c, { 'Size' : [ 0x0, ['unsigned long']], @@ -683,10 +683,10 @@ nt_types = { 'Entry' : [ 0x20, ['array', 2, ['pointer', ['_MMMOD_WRITER_MDL_ENTRY']]]], 'PageFileName' : [ 0x28, ['_UNICODE_STRING']], 'Bitmap' : [ 0x30, ['pointer', ['_RTL_BITMAP']]], - 'PageFileNumber' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'ReferenceCount' : [ 0x34, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'BootPartition' : [ 0x34, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Reserved' : [ 0x34, ['BitField', dict(start_bit = 9, end_bit = 32)]], + 'PageFileNumber' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'ReferenceCount' : [ 0x34, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'BootPartition' : [ 0x34, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Reserved' : [ 0x34, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], 'FileHandle' : [ 0x38, ['pointer', ['void']]], } ], '_EXCEPTION_RECORD64' : [ 0x98, { @@ -816,7 +816,7 @@ nt_types = { 'MaxInstructions' : [ 0x14, ['unsigned long']], 'TotalInstructions' : [ 0x18, ['unsigned long']], } ], - '__unnamed_11c8' : [ 0x28, { + '__unnamed_11ca' : [ 0x28, { 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], @@ -845,9 +845,9 @@ nt_types = { 'ProcessorLevel' : [ 0x4, ['unsigned short']], 'Processor' : [ 0x6, ['unsigned short']], 'ReturnStatus' : [ 0x8, ['long']], - 'u' : [ 0x10, ['__unnamed_11c8']], + 'u' : [ 0x10, ['__unnamed_11ca']], } ], - '__unnamed_11cf' : [ 0x28, { + '__unnamed_11d1' : [ 0x28, { 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], @@ -874,16 +874,16 @@ nt_types = { 'ProcessorLevel' : [ 0x4, ['unsigned short']], 'Processor' : [ 0x6, ['unsigned short']], 'ReturnStatus' : [ 0x8, ['long']], - 'u' : [ 0xc, ['__unnamed_11cf']], + 'u' : [ 0xc, ['__unnamed_11d1']], } ], - '__unnamed_11de' : [ 0x8, { + '__unnamed_11e0' : [ 0x8, { 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], 'ActiveCount' : [ 0x0, ['unsigned short']], } ], '_VACB' : [ 0x18, { 'BaseAddress' : [ 0x0, ['pointer', ['void']]], 'SharedCacheMap' : [ 0x4, ['pointer', ['_SHARED_CACHE_MAP']]], - 'Overlay' : [ 0x8, ['__unnamed_11de']], + 'Overlay' : [ 0x8, ['__unnamed_11e0']], 'LruList' : [ 0x10, ['_LIST_ENTRY']], } ], '_SHARED_CACHE_MAP' : [ 0x130, { @@ -933,11 +933,11 @@ nt_types = { 'Reference' : [ 0x0, ['long']], 'SpecialReference' : [ 0x4, ['long']], } ], - '__unnamed_1200' : [ 0x10, { + '__unnamed_1202' : [ 0x10, { 'FreeListsInUseUlong' : [ 0x0, ['array', 4, ['unsigned long']]], 'FreeListsInUseBytes' : [ 0x0, ['array', 16, ['unsigned char']]], } ], - '__unnamed_1202' : [ 0x2, { + '__unnamed_1204' : [ 0x2, { 'FreeListsInUseTerminate' : [ 0x0, ['unsigned short']], 'DecommitCount' : [ 0x0, ['unsigned short']], } ], @@ -965,8 +965,8 @@ nt_types = { 'AlignMask' : [ 0x4c, ['unsigned long']], 'VirtualAllocdBlocks' : [ 0x50, ['_LIST_ENTRY']], 'Segments' : [ 0x58, ['array', 64, ['pointer', ['_HEAP_SEGMENT']]]], - 'u' : [ 0x158, ['__unnamed_1200']], - 'u2' : [ 0x168, ['__unnamed_1202']], + 'u' : [ 0x158, ['__unnamed_1202']], + 'u2' : [ 0x168, ['__unnamed_1204']], 'AllocatorBackTraceIndex' : [ 0x16a, ['unsigned short']], 'NonDedicatedListLength' : [ 0x16c, ['unsigned long']], 'LargeBlocksIndex' : [ 0x170, ['pointer', ['void']]], @@ -1195,7 +1195,7 @@ nt_types = { 'MmSectionFlags' : [ 0x24, ['pointer', ['_MMSECTION_FLAGS']]], 'MmSubSectionFlags' : [ 0x28, ['pointer', ['_MMSUBSECTION_FLAGS']]], } ], - '__unnamed_12e8' : [ 0x4, { + '__unnamed_12ea' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], } ], @@ -1207,7 +1207,7 @@ nt_types = { 'NumberOfMappedViews' : [ 0x14, ['unsigned long']], 'NumberOfSystemCacheViews' : [ 0x18, ['unsigned long']], 'NumberOfUserReferences' : [ 0x1c, ['unsigned long']], - 'u' : [ 0x20, ['__unnamed_12e8']], + 'u' : [ 0x20, ['__unnamed_12ea']], 'FilePointer' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], 'WaitingForDeletion' : [ 0x28, ['pointer', ['_EVENT_COUNTER']]], 'ModifiedWriteCount' : [ 0x2c, ['unsigned short']], @@ -1227,25 +1227,25 @@ nt_types = { 'NextHandleNeedingPool' : [ 0x38, ['unsigned long']], 'HandleCount' : [ 0x3c, ['long']], 'Flags' : [ 0x40, ['unsigned long']], - 'StrictFIFO' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], } ], '_POOL_HEADER' : [ 0x8, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16)]], - 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'AllocatorBackTraceIndex' : [ 0x4, ['unsigned short']], 'PoolTagHash' : [ 0x6, ['unsigned short']], } ], '_MMPTE_PROTOTYPE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_MMSUPPORT' : [ 0x60, { 'WorkingSetExpansionLinks' : [ 0x0, ['_LIST_ENTRY']], @@ -1273,14 +1273,14 @@ nt_types = { 'Info' : [ 0x38, ['EX_QUEUE_WORKER_INFO']], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20)]], - 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20, native_type='unsigned long')]], + 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], } ], '_HEAP_TAG_ENTRY' : [ 0x40, { 'Allocs' : [ 0x0, ['unsigned long']], @@ -1372,7 +1372,7 @@ nt_types = { 'NumberOfSubsections' : [ 0x18, ['unsigned short']], 'FlushInProgressCount' : [ 0x1a, ['unsigned short']], 'NumberOfUserReferences' : [ 0x1c, ['unsigned long']], - 'u' : [ 0x20, ['__unnamed_12e8']], + 'u' : [ 0x20, ['__unnamed_12ea']], 'FilePointer' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], 'WaitingForDeletion' : [ 0x28, ['pointer', ['_EVENT_COUNTER']]], 'ModifiedWriteCount' : [ 0x2c, ['unsigned short']], @@ -1381,32 +1381,32 @@ nt_types = { 'UserGlobalList' : [ 0x34, ['_LIST_ENTRY']], 'SessionId' : [ 0x3c, ['unsigned long']], } ], - '__unnamed_1324' : [ 0x4, { + '__unnamed_1326' : [ 0x4, { 'BaseMid' : [ 0x0, ['unsigned char']], 'Flags1' : [ 0x1, ['unsigned char']], 'Flags2' : [ 0x2, ['unsigned char']], 'BaseHi' : [ 0x3, ['unsigned char']], -} ], - '__unnamed_132b' : [ 0x4, { - 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], } ], '__unnamed_132d' : [ 0x4, { - 'Bytes' : [ 0x0, ['__unnamed_1324']], - 'Bits' : [ 0x0, ['__unnamed_132b']], + 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_132f' : [ 0x4, { + 'Bytes' : [ 0x0, ['__unnamed_1326']], + 'Bits' : [ 0x0, ['__unnamed_132d']], } ], '_KGDTENTRY' : [ 0x8, { 'LimitLow' : [ 0x0, ['unsigned short']], 'BaseLow' : [ 0x2, ['unsigned short']], - 'HighWord' : [ 0x4, ['__unnamed_132d']], + 'HighWord' : [ 0x4, ['__unnamed_132f']], } ], '_PS_JOB_TOKEN_FILTER' : [ 0x24, { 'CapturedSidCount' : [ 0x0, ['unsigned long']], @@ -1487,19 +1487,19 @@ nt_types = { 'CompletionContext' : [ 0x6c, ['pointer', ['_IO_COMPLETION_CONTEXT']]], } ], '_MMPTE_HARDWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Writable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x8, { 'Port' : [ 0x0, ['pointer', ['void']]], @@ -1521,37 +1521,37 @@ nt_types = { 'ContextFlags' : [ 0x0, ['unsigned long']], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'HadUserReference' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'filler' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'HadUserReference' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'filler' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 32, native_type='unsigned long')]], } ], '_DEFERRED_WRITE' : [ 0x28, { 'NodeTypeCode' : [ 0x0, ['short']], @@ -1590,14 +1590,14 @@ nt_types = { 'EffectiveOnly' : [ 0x5, ['unsigned char']], 'ImpersonationLevel' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], } ], - '__unnamed_1391' : [ 0x4, { + '__unnamed_1393' : [ 0x4, { 'LegacyDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], 'PendingDeviceRelations' : [ 0x0, ['pointer', ['_DEVICE_RELATIONS']]], } ], - '__unnamed_1393' : [ 0x4, { + '__unnamed_1395' : [ 0x4, { 'NextResourceDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], } ], - '__unnamed_1397' : [ 0x10, { + '__unnamed_1399' : [ 0x10, { 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], 'ListEntry' : [ 0x4, ['_LIST_ENTRY']], 'SerialNumber' : [ 0xc, ['pointer', ['unsigned short']]], @@ -1639,21 +1639,21 @@ nt_types = { 'QueryTranslatorMask' : [ 0xda, ['unsigned short']], 'NoArbiterMask' : [ 0xdc, ['unsigned short']], 'QueryArbiterMask' : [ 0xde, ['unsigned short']], - 'OverUsed1' : [ 0xe0, ['__unnamed_1391']], - 'OverUsed2' : [ 0xe4, ['__unnamed_1393']], + 'OverUsed1' : [ 0xe0, ['__unnamed_1393']], + 'OverUsed2' : [ 0xe4, ['__unnamed_1395']], 'BootResources' : [ 0xe8, ['pointer', ['_CM_RESOURCE_LIST']]], 'CapabilityFlags' : [ 0xec, ['unsigned long']], - 'DockInfo' : [ 0xf0, ['__unnamed_1397']], + 'DockInfo' : [ 0xf0, ['__unnamed_1399']], 'DisableableDepends' : [ 0x100, ['unsigned long']], 'PendedSetInterfaceState' : [ 0x104, ['_LIST_ENTRY']], 'LegacyBusListEntry' : [ 0x10c, ['_LIST_ENTRY']], } ], - '__unnamed_139c' : [ 0x38, { + '__unnamed_139e' : [ 0x38, { 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], 'Resource' : [ 0x0, ['_ERESOURCE']], } ], '_HEAP_LOCK' : [ 0x38, { - 'Lock' : [ 0x0, ['__unnamed_139c']], + 'Lock' : [ 0x0, ['__unnamed_139e']], } ], '_MMCOLOR_TABLES' : [ 0xc, { 'Flink' : [ 0x0, ['unsigned long']], @@ -1681,14 +1681,14 @@ nt_types = { 'BasePage' : [ 0x0, ['unsigned long']], 'PageCount' : [ 0x4, ['unsigned long']], } ], - '__unnamed_13b1' : [ 0x4, { + '__unnamed_13b3' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], } ], '_MM_SESSION_SPACE' : [ 0x1f00, { 'GlobalVirtualAddress' : [ 0x0, ['pointer', ['_MM_SESSION_SPACE']]], 'ReferenceCount' : [ 0x4, ['unsigned long']], - 'u' : [ 0x8, ['__unnamed_13b1']], + 'u' : [ 0x8, ['__unnamed_13b3']], 'SessionId' : [ 0xc, ['unsigned long']], 'ProcessList' : [ 0x10, ['_LIST_ENTRY']], 'LastProcessSwappedOutTime' : [ 0x18, ['_LARGE_INTEGER']], @@ -1736,8 +1736,8 @@ nt_types = { 'EnvironmentUpdateCount' : [ 0x28, ['unsigned long']], 'KernelCallbackTable' : [ 0x2c, ['pointer', ['void']]], 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], - 'ExecuteOptions' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'SpareBits' : [ 0x34, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'ExecuteOptions' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'SpareBits' : [ 0x34, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'FreeList' : [ 0x38, ['pointer', ['_PEB_FREE_BLOCK']]], 'TlsExpansionCounter' : [ 0x3c, ['unsigned long']], 'TlsBitmap' : [ 0x40, ['pointer', ['void']]], @@ -1806,12 +1806,12 @@ nt_types = { 'Unused' : [ 0x0, ['unsigned long']], } ], '_MMPTE_SOFTWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { 'ListSize' : [ 0x0, ['unsigned long']], @@ -1822,14 +1822,14 @@ nt_types = { 'AlternativeLists' : [ 0x1c, ['unsigned long']], 'List' : [ 0x20, ['array', 1, ['_IO_RESOURCE_LIST']]], } ], - '__unnamed_13e1' : [ 0x8, { + '__unnamed_13e3' : [ 0x8, { 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], 'LastByte' : [ 0x0, ['_LARGE_INTEGER']], } ], '_MMMOD_WRITER_MDL_ENTRY' : [ 0x60, { 'Links' : [ 0x0, ['_LIST_ENTRY']], 'WriteOffset' : [ 0x8, ['_LARGE_INTEGER']], - 'u' : [ 0x10, ['__unnamed_13e1']], + 'u' : [ 0x10, ['__unnamed_13e3']], 'Irp' : [ 0x18, ['pointer', ['_IRP']]], 'LastPageToWrite' : [ 0x1c, ['unsigned long']], 'PagingListHead' : [ 0x20, ['pointer', ['_MMMOD_WRITER_LISTHEAD']]], @@ -1866,13 +1866,13 @@ nt_types = { 'Peak' : [ 0x8, ['unsigned long']], 'Return' : [ 0xc, ['unsigned long']], } ], - '__unnamed_13f7' : [ 0x50, { + '__unnamed_13f9' : [ 0x50, { 'CellData' : [ 0x0, ['_CELL_DATA']], 'List' : [ 0x0, ['array', 1, ['unsigned long']]], } ], '_CM_CACHED_VALUE_INDEX' : [ 0x54, { 'CellIndex' : [ 0x0, ['unsigned long']], - 'Data' : [ 0x4, ['__unnamed_13f7']], + 'Data' : [ 0x4, ['__unnamed_13f9']], } ], '_KSEMAPHORE' : [ 0x14, { 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], @@ -1929,17 +1929,17 @@ nt_types = { 'DataValueHigh' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x4, { - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11)]], - 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11, native_type='unsigned long')]], + 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], } ], '_IO_COUNTERS' : [ 0x30, { 'ReadOperationCount' : [ 0x0, ['unsigned long long']], @@ -2016,18 +2016,18 @@ nt_types = { 'Volume' : [ 0x44, ['_LIST_ENTRY']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Available0' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'MemoryPriority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'GrowWsleHash' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AcquiredUnsafe' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Available' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Available0' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'GrowWsleHash' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'AcquiredUnsafe' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Available' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], '_KSYSTEM_TIME' : [ 0xc, { 'LowPart' : [ 0x0, ['unsigned long']], @@ -2111,8 +2111,8 @@ nt_types = { 'Revision' : [ 0x0, ['unsigned long']], 'DynamicThrottle' : [ 0x4, ['unsigned char']], 'Spare' : [ 0x5, ['array', 3, ['unsigned char']]], - 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'PolicyCount' : [ 0xc, ['unsigned long']], 'Policy' : [ 0x10, ['array', 3, ['_PROCESSOR_POWER_POLICY_INFO']]], } ], @@ -2167,10 +2167,10 @@ nt_types = { 'RegisterArea' : [ 0x1c, ['array', 80, ['unsigned char']]], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'SYSTEM_POWER_LEVEL' : [ 0x18, { @@ -2229,12 +2229,12 @@ nt_types = { '_tmpfname' : [ 0x1c, ['pointer', ['unsigned char']]], } ], '_MMPTE_LIST' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_CMHIVE' : [ 0x56c, { 'Hive' : [ 0x0, ['_HHIVE']], @@ -2330,9 +2330,9 @@ nt_types = { 'Name' : [ 0xc, ['array', 1, ['unsigned short']]], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x18, { 'Version' : [ 0x0, ['unsigned short']], @@ -2340,7 +2340,7 @@ nt_types = { 'Count' : [ 0x4, ['unsigned long']], 'PartialDescriptors' : [ 0x8, ['array', 1, ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], } ], - '__unnamed_14c5' : [ 0x28, { + '__unnamed_14c7' : [ 0x28, { 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], } ], @@ -2359,7 +2359,7 @@ nt_types = { 'DeviceExtension' : [ 0x28, ['pointer', ['void']]], 'DeviceType' : [ 0x2c, ['unsigned long']], 'StackSize' : [ 0x30, ['unsigned char']], - 'Queue' : [ 0x34, ['__unnamed_14c5']], + 'Queue' : [ 0x34, ['__unnamed_14c7']], 'AlignmentRequirement' : [ 0x5c, ['unsigned long']], 'DeviceQueue' : [ 0x60, ['_KDEVICE_QUEUE']], 'Dpc' : [ 0x74, ['_KDPC']], @@ -2383,9 +2383,9 @@ nt_types = { } ], '_MM_AVL_TABLE' : [ 0x20, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'NodeHint' : [ 0x18, ['pointer', ['void']]], 'NodeFreeHint' : [ 0x1c, ['pointer', ['void']]], } ], @@ -2487,13 +2487,13 @@ nt_types = { 'QueryNameProcedure' : [ 0x44, ['pointer', ['void']]], 'OkayToCloseProcedure' : [ 0x48, ['pointer', ['void']]], } ], - '__unnamed_1513' : [ 0x4, { + '__unnamed_1515' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], } ], '_SUBSECTION' : [ 0x20, { 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], - 'u' : [ 0x4, ['__unnamed_1513']], + 'u' : [ 0x4, ['__unnamed_1515']], 'StartingSector' : [ 0x8, ['unsigned long']], 'NumberOfFullSectors' : [ 0xc, ['unsigned long']], 'SubsectionBase' : [ 0x10, ['pointer', ['_MMPTE']]], @@ -2501,51 +2501,51 @@ nt_types = { 'PtesInSubsection' : [ 0x18, ['unsigned long']], 'NextSubsection' : [ 0x1c, ['pointer', ['_SUBSECTION']]], } ], - '__unnamed_151c' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + '__unnamed_151e' : [ 0x4, { + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMVAD']]], } ], - '__unnamed_151f' : [ 0x4, { + '__unnamed_1521' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], } ], - '__unnamed_1522' : [ 0x4, { + '__unnamed_1524' : [ 0x4, { 'LongFlags2' : [ 0x0, ['unsigned long']], 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], } ], - '__unnamed_1525' : [ 0x8, { + '__unnamed_1527' : [ 0x8, { 'List' : [ 0x0, ['_LIST_ENTRY']], 'Secured' : [ 0x0, ['_MMADDRESS_LIST']], } ], - '__unnamed_152b' : [ 0x4, { + '__unnamed_152d' : [ 0x4, { 'Banked' : [ 0x0, ['pointer', ['_MMBANKED_SECTION']]], 'ExtendedInfo' : [ 0x0, ['pointer', ['_MMEXTEND_INFO']]], } ], '_MMVAD_LONG' : [ 0x34, { - 'u1' : [ 0x0, ['__unnamed_151c']], + 'u1' : [ 0x0, ['__unnamed_151e']], 'LeftChild' : [ 0x4, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x8, ['pointer', ['_MMVAD']]], 'StartingVpn' : [ 0xc, ['unsigned long']], 'EndingVpn' : [ 0x10, ['unsigned long']], - 'u' : [ 0x14, ['__unnamed_151f']], + 'u' : [ 0x14, ['__unnamed_1521']], 'ControlArea' : [ 0x18, ['pointer', ['_CONTROL_AREA']]], 'FirstPrototypePte' : [ 0x1c, ['pointer', ['_MMPTE']]], 'LastContiguousPte' : [ 0x20, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x24, ['__unnamed_1522']], - 'u3' : [ 0x28, ['__unnamed_1525']], - 'u4' : [ 0x30, ['__unnamed_152b']], + 'u2' : [ 0x24, ['__unnamed_1524']], + 'u3' : [ 0x28, ['__unnamed_1527']], + 'u4' : [ 0x30, ['__unnamed_152d']], } ], '_MMVAD_FLAGS' : [ 0x4, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19)]], - 'PhysicalMapping' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'ImageMap' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'UserPhysicalPages' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'WriteWatch' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19, native_type='unsigned long')]], + 'PhysicalMapping' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ImageMap' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'UserPhysicalPages' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'WriteWatch' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_POOL_DESCRIPTOR' : [ 0x1030, { 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], @@ -2563,19 +2563,19 @@ nt_types = { 'ListHeads' : [ 0x30, ['array', 512, ['_LIST_ENTRY']]], } ], '_HARDWARE_PTE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_PEB_LDR_DATA' : [ 0x28, { 'Length' : [ 0x0, ['unsigned long']], @@ -2662,8 +2662,8 @@ nt_types = { 'Handler' : [ 0x4, ['pointer', ['void']]], } ], '_SEP_AUDIT_POLICY_OVERLAY' : [ 0x8, { - 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36)]], - 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37)]], + 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], } ], '_POOL_TRACKER_BIG_PAGES' : [ 0x10, { 'Va' : [ 0x0, ['pointer', ['void']]], @@ -2676,12 +2676,12 @@ nt_types = { 'FaultingVa' : [ 0x4, ['pointer', ['void']]], } ], '_MMPTE_SUBSECTION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 31)]], - 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 31, native_type='unsigned long')]], + 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_VI_DEADLOCK_NODE' : [ 0x68, { 'Parent' : [ 0x0, ['pointer', ['_VI_DEADLOCK_NODE']]], @@ -2691,10 +2691,10 @@ nt_types = { 'FreeListEntry' : [ 0x14, ['_LIST_ENTRY']], 'Root' : [ 0x1c, ['pointer', ['_VI_DEADLOCK_RESOURCE']]], 'ThreadEntry' : [ 0x20, ['pointer', ['_VI_DEADLOCK_THREAD']]], - 'Active' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x24, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x24, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'StackTrace' : [ 0x28, ['array', 8, ['pointer', ['void']]]], 'ParentStackTrace' : [ 0x48, ['array', 8, ['pointer', ['void']]]], } ], @@ -2850,18 +2850,18 @@ nt_types = { 'Sacl' : [ 0xc, ['pointer', ['_ACL']]], 'Dacl' : [ 0x10, ['pointer', ['_ACL']]], } ], - '__unnamed_159e' : [ 0x8, { + '__unnamed_15a1' : [ 0x8, { 'UserData' : [ 0x0, ['pointer', ['void']]], 'Owner' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_15a0' : [ 0x8, { + '__unnamed_15a3' : [ 0x8, { 'ListHead' : [ 0x0, ['_LIST_ENTRY']], } ], '_RTLP_RANGE_LIST_ENTRY' : [ 0x28, { 'Start' : [ 0x0, ['unsigned long long']], 'End' : [ 0x8, ['unsigned long long']], - 'Allocated' : [ 0x10, ['__unnamed_159e']], - 'Merged' : [ 0x10, ['__unnamed_15a0']], + 'Allocated' : [ 0x10, ['__unnamed_15a1']], + 'Merged' : [ 0x10, ['__unnamed_15a3']], 'Attributes' : [ 0x18, ['unsigned char']], 'PublicFlags' : [ 0x19, ['unsigned char']], 'PrivateFlags' : [ 0x1a, ['unsigned short']], @@ -2982,7 +2982,7 @@ nt_types = { 'V86Fs' : [ 0x84, ['unsigned long']], 'V86Gs' : [ 0x88, ['unsigned long']], } ], - '__unnamed_15d1' : [ 0x5, { + '__unnamed_15d4' : [ 0x5, { 'Acquired' : [ 0x0, ['unsigned char']], 'CacheLineSize' : [ 0x1, ['unsigned char']], 'LatencyTimer' : [ 0x2, ['unsigned char']], @@ -3018,51 +3018,51 @@ nt_types = { 'ChildWaitWakeCount' : [ 0xc4, ['unsigned long']], 'IchHackConfig' : [ 0xc8, ['pointer', ['_PCI_COMMON_CONFIG']]], 'Lock' : [ 0xcc, ['_PCI_LOCK']], - 'HotPlugParameters' : [ 0xd4, ['__unnamed_15d1']], + 'HotPlugParameters' : [ 0xd4, ['__unnamed_15d4']], 'BusHackFlags' : [ 0xdc, ['unsigned long']], } ], - '__unnamed_15d5' : [ 0xc, { + '__unnamed_15d8' : [ 0xc, { 'Start' : [ 0x0, ['_LARGE_INTEGER']], 'Length' : [ 0x8, ['unsigned long']], } ], - '__unnamed_15d7' : [ 0xc, { + '__unnamed_15da' : [ 0xc, { 'Level' : [ 0x0, ['unsigned long']], 'Vector' : [ 0x4, ['unsigned long']], 'Affinity' : [ 0x8, ['unsigned long']], } ], - '__unnamed_15d9' : [ 0xc, { + '__unnamed_15dc' : [ 0xc, { 'Channel' : [ 0x0, ['unsigned long']], 'Port' : [ 0x4, ['unsigned long']], 'Reserved1' : [ 0x8, ['unsigned long']], } ], - '__unnamed_15db' : [ 0xc, { + '__unnamed_15de' : [ 0xc, { 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], } ], - '__unnamed_15dd' : [ 0xc, { + '__unnamed_15e0' : [ 0xc, { 'Start' : [ 0x0, ['unsigned long']], 'Length' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned long']], } ], - '__unnamed_15df' : [ 0xc, { + '__unnamed_15e2' : [ 0xc, { 'DataSize' : [ 0x0, ['unsigned long']], 'Reserved1' : [ 0x4, ['unsigned long']], 'Reserved2' : [ 0x8, ['unsigned long']], } ], - '__unnamed_15e1' : [ 0xc, { - 'Generic' : [ 0x0, ['__unnamed_15d5']], - 'Port' : [ 0x0, ['__unnamed_15d5']], - 'Interrupt' : [ 0x0, ['__unnamed_15d7']], - 'Memory' : [ 0x0, ['__unnamed_15d5']], - 'Dma' : [ 0x0, ['__unnamed_15d9']], - 'DevicePrivate' : [ 0x0, ['__unnamed_15db']], - 'BusNumber' : [ 0x0, ['__unnamed_15dd']], - 'DeviceSpecificData' : [ 0x0, ['__unnamed_15df']], + '__unnamed_15e4' : [ 0xc, { + 'Generic' : [ 0x0, ['__unnamed_15d8']], + 'Port' : [ 0x0, ['__unnamed_15d8']], + 'Interrupt' : [ 0x0, ['__unnamed_15da']], + 'Memory' : [ 0x0, ['__unnamed_15d8']], + 'Dma' : [ 0x0, ['__unnamed_15dc']], + 'DevicePrivate' : [ 0x0, ['__unnamed_15de']], + 'BusNumber' : [ 0x0, ['__unnamed_15e0']], + 'DeviceSpecificData' : [ 0x0, ['__unnamed_15e2']], } ], '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x10, { 'Type' : [ 0x0, ['unsigned char']], 'ShareDisposition' : [ 0x1, ['unsigned char']], 'Flags' : [ 0x2, ['unsigned short']], - 'u' : [ 0x4, ['__unnamed_15e1']], + 'u' : [ 0x4, ['__unnamed_15e4']], } ], '_WAIT_CONTEXT_BLOCK' : [ 0x28, { 'WaitQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], @@ -3076,11 +3076,11 @@ nt_types = { '_CM_KEY_CONTROL_BLOCK' : [ 0x48, { 'RefCount' : [ 0x0, ['unsigned short']], 'Flags' : [ 0x2, ['unsigned short']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x8, ['unsigned long']], 'NextHash' : [ 0xc, ['pointer', ['_CM_KEY_HASH']]], @@ -3140,15 +3140,15 @@ nt_types = { 'ResourcesChanged' : [ 0x35, ['unsigned char']], } ], '_SEP_AUDIT_POLICY_CATEGORIES' : [ 0x8, { - 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28)]], - 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], - 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28, native_type='unsigned long')]], + 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], + 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], } ], '_CM_KEY_HASH' : [ 0x10, { 'ConvKey' : [ 0x0, ['unsigned long']], @@ -3156,20 +3156,20 @@ nt_types = { 'KeyHive' : [ 0x8, ['pointer', ['_HHIVE']]], 'KeyCell' : [ 0xc, ['unsigned long']], } ], - '__unnamed_161b' : [ 0x4, { + '__unnamed_161e' : [ 0x4, { 'MasterIrp' : [ 0x0, ['pointer', ['_IRP']]], 'IrpCount' : [ 0x0, ['long']], 'SystemBuffer' : [ 0x0, ['pointer', ['void']]], } ], - '__unnamed_1621' : [ 0x8, { + '__unnamed_1624' : [ 0x8, { 'UserApcRoutine' : [ 0x0, ['pointer', ['void']]], 'UserApcContext' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_1623' : [ 0x8, { - 'AsynchronousParameters' : [ 0x0, ['__unnamed_1621']], + '__unnamed_1626' : [ 0x8, { + 'AsynchronousParameters' : [ 0x0, ['__unnamed_1624']], 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], } ], - '__unnamed_162b' : [ 0x28, { + '__unnamed_162e' : [ 0x28, { 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], 'DriverContext' : [ 0x0, ['array', 4, ['pointer', ['void']]]], 'Thread' : [ 0x10, ['pointer', ['_ETHREAD']]], @@ -3179,8 +3179,8 @@ nt_types = { 'PacketType' : [ 0x20, ['unsigned long']], 'OriginalFileObject' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], } ], - '__unnamed_162d' : [ 0x30, { - 'Overlay' : [ 0x0, ['__unnamed_162b']], + '__unnamed_1630' : [ 0x30, { + 'Overlay' : [ 0x0, ['__unnamed_162e']], 'Apc' : [ 0x0, ['_KAPC']], 'CompletionKey' : [ 0x0, ['pointer', ['void']]], } ], @@ -3189,7 +3189,7 @@ nt_types = { 'Size' : [ 0x2, ['unsigned short']], 'MdlAddress' : [ 0x4, ['pointer', ['_MDL']]], 'Flags' : [ 0x8, ['unsigned long']], - 'AssociatedIrp' : [ 0xc, ['__unnamed_161b']], + 'AssociatedIrp' : [ 0xc, ['__unnamed_161e']], 'ThreadListEntry' : [ 0x10, ['_LIST_ENTRY']], 'IoStatus' : [ 0x18, ['_IO_STATUS_BLOCK']], 'RequestorMode' : [ 0x20, ['unsigned char']], @@ -3202,10 +3202,10 @@ nt_types = { 'AllocationFlags' : [ 0x27, ['unsigned char']], 'UserIosb' : [ 0x28, ['pointer', ['_IO_STATUS_BLOCK']]], 'UserEvent' : [ 0x2c, ['pointer', ['_KEVENT']]], - 'Overlay' : [ 0x30, ['__unnamed_1623']], + 'Overlay' : [ 0x30, ['__unnamed_1626']], 'CancelRoutine' : [ 0x38, ['pointer', ['void']]], 'UserBuffer' : [ 0x3c, ['pointer', ['void']]], - 'Tail' : [ 0x40, ['__unnamed_162d']], + 'Tail' : [ 0x40, ['__unnamed_1630']], } ], '_PCI_LOCK' : [ 0x8, { 'Atom' : [ 0x0, ['unsigned long']], @@ -3215,13 +3215,13 @@ nt_types = { 'Cell' : [ 0x0, ['unsigned long']], 'CachedSecurity' : [ 0x4, ['pointer', ['_CM_KEY_SECURITY_CACHE']]], } ], - '__unnamed_1638' : [ 0x4, { + '__unnamed_163b' : [ 0x4, { 'PhysicalAddress' : [ 0x0, ['unsigned long']], 'VirtualSize' : [ 0x0, ['unsigned long']], } ], '_IMAGE_SECTION_HEADER' : [ 0x28, { 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], - 'Misc' : [ 0x8, ['__unnamed_1638']], + 'Misc' : [ 0x8, ['__unnamed_163b']], 'VirtualAddress' : [ 0xc, ['unsigned long']], 'SizeOfRawData' : [ 0x10, ['unsigned long']], 'PointerToRawData' : [ 0x14, ['unsigned long']], @@ -3231,14 +3231,14 @@ nt_types = { 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], 'Characteristics' : [ 0x24, ['unsigned long']], } ], - '__unnamed_163e' : [ 0x4, { + '__unnamed_1641' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], } ], '_POP_ACTION_TRIGGER' : [ 0xc, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyInitiatePowerActionAPI', 4: 'PolicySetPowerStateAPI', 5: 'PolicyImmediateDozeS4', 6: 'PolicySystemIdle'})]], 'Flags' : [ 0x4, ['unsigned char']], 'Spare' : [ 0x5, ['array', 3, ['unsigned char']]], - 'Battery' : [ 0x8, ['__unnamed_163e']], + 'Battery' : [ 0x8, ['__unnamed_1641']], 'Wait' : [ 0x8, ['pointer', ['_POP_TRIGGER_WAIT']]], } ], '_ETIMER' : [ 0x98, { @@ -3261,34 +3261,34 @@ nt_types = { 'NewCell' : [ 0x4, ['unsigned long']], } ], '_PCI_PMC' : [ 0x2, { - 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], 'Support' : [ 0x1, ['_PM_SUPPORT']], } ], '_DBGKD_CONTINUE' : [ 0x4, { 'ContinueStatus' : [ 0x0, ['long']], } ], - '__unnamed_1655' : [ 0x4, { + '__unnamed_1658' : [ 0x4, { 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], 'Long' : [ 0x0, ['unsigned long']], 'e1' : [ 0x0, ['_MMWSLENTRY']], } ], '_MMWSLE' : [ 0x4, { - 'u1' : [ 0x0, ['__unnamed_1655']], + 'u1' : [ 0x0, ['__unnamed_1658']], } ], '_EXCEPTION_POINTERS' : [ 0x8, { 'ExceptionRecord' : [ 0x0, ['pointer', ['_EXCEPTION_RECORD']]], 'ContextRecord' : [ 0x4, ['pointer', ['_CONTEXT']]], } ], - '__unnamed_165d' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + '__unnamed_1660' : [ 0x4, { + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x14, { - 'u1' : [ 0x0, ['__unnamed_165d']], + 'u1' : [ 0x0, ['__unnamed_1660']], 'LeftChild' : [ 0x4, ['pointer', ['_MMADDRESS_NODE']]], 'RightChild' : [ 0x8, ['pointer', ['_MMADDRESS_NODE']]], 'StartingVpn' : [ 0xc, ['unsigned long']], @@ -3344,8 +3344,8 @@ nt_types = { } ], '_VI_DEADLOCK_RESOURCE' : [ 0x80, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockQueuedSpinLock', 7: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer', ['void']]], 'ThreadOwner' : [ 0xc, ['pointer', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x10, ['_LIST_ENTRY']], @@ -3381,23 +3381,23 @@ nt_types = { 'Flink' : [ 0x8, ['unsigned long']], 'Blink' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1681' : [ 0x4, { + '__unnamed_1684' : [ 0x4, { 'Spare' : [ 0x0, ['array', 4, ['unsigned char']]], } ], - '__unnamed_1683' : [ 0x4, { + '__unnamed_1686' : [ 0x4, { 'PrimaryBus' : [ 0x0, ['unsigned char']], 'SecondaryBus' : [ 0x1, ['unsigned char']], 'SubordinateBus' : [ 0x2, ['unsigned char']], - 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], } ], 'PCI_HEADER_TYPE_DEPENDENT' : [ 0x4, { - 'type0' : [ 0x0, ['__unnamed_1681']], - 'type1' : [ 0x0, ['__unnamed_1683']], - 'type2' : [ 0x0, ['__unnamed_1683']], + 'type0' : [ 0x0, ['__unnamed_1684']], + 'type1' : [ 0x0, ['__unnamed_1686']], + 'type2' : [ 0x0, ['__unnamed_1686']], } ], '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { 'BusDataType' : [ 0x0, ['unsigned long']], @@ -3499,14 +3499,14 @@ nt_types = { 'Align16Byte' : [ 0x200, ['array', 8, ['unsigned char']]], } ], '_MMWSLENTRY' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'SameProtectAsProto' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'SameProtectAsProto' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_OBJECT_DIRECTORY' : [ 0xa0, { 'HashBuckets' : [ 0x0, ['array', 37, ['pointer', ['_OBJECT_DIRECTORY_ENTRY']]]], @@ -3600,11 +3600,11 @@ nt_types = { 'Abandoned' : [ 0x1c, ['unsigned char']], 'ApcDisable' : [ 0x1d, ['unsigned char']], } ], - '__unnamed_16f1' : [ 0x4, { + '__unnamed_16f4' : [ 0x4, { 'ImageCommitment' : [ 0x0, ['unsigned long']], 'CreatingProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], } ], - '__unnamed_16f5' : [ 0x4, { + '__unnamed_16f8' : [ 0x4, { 'ImageInformation' : [ 0x0, ['pointer', ['_SECTION_IMAGE_INFORMATION']]], 'FirstMappedVa' : [ 0x0, ['pointer', ['void']]], } ], @@ -3619,8 +3619,8 @@ nt_types = { 'ExtendInfo' : [ 0x20, ['pointer', ['_MMEXTEND_INFO']]], 'SegmentFlags' : [ 0x24, ['_SEGMENT_FLAGS']], 'BasedAddress' : [ 0x28, ['pointer', ['void']]], - 'u1' : [ 0x2c, ['__unnamed_16f1']], - 'u2' : [ 0x30, ['__unnamed_16f5']], + 'u1' : [ 0x2c, ['__unnamed_16f4']], + 'u2' : [ 0x30, ['__unnamed_16f8']], 'PrototypePte' : [ 0x34, ['pointer', ['_MMPTE']]], 'ThePtes' : [ 0x38, ['array', 1, ['_MMPTE']]], } ], @@ -3836,7 +3836,7 @@ nt_types = { 'ExtensionType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1768116272: 'PciPdoExtensionType', 1768116273: 'PciFdoExtensionType', 1768116274: 'PciArb_Io', 1768116275: 'PciArb_Memory', 1768116276: 'PciArb_Interrupt', 1768116277: 'PciArb_BusNumber', 1768116278: 'PciTrans_Interrupt', 1768116279: 'PciInterface_BusHandler', 1768116280: 'PciInterface_IntRouteHandler', 1768116281: 'PciInterface_PciCb', 1768116282: 'PciInterface_LegacyDeviceDetection', 1768116283: 'PciInterface_PmeHandler', 1768116284: 'PciInterface_DevicePresent', 1768116285: 'PciInterface_NativeIde', 1768116286: 'PciInterface_Location', 1768116287: 'PciInterface_AgpTarget'})]], 'Destructor' : [ 0x8, ['pointer', ['void']]], } ], - '__unnamed_1734' : [ 0x30, { + '__unnamed_1737' : [ 0x30, { 'type0' : [ 0x0, ['_PCI_HEADER_TYPE_0']], 'type1' : [ 0x0, ['_PCI_HEADER_TYPE_1']], 'type2' : [ 0x0, ['_PCI_HEADER_TYPE_2']], @@ -3854,7 +3854,7 @@ nt_types = { 'LatencyTimer' : [ 0xd, ['unsigned char']], 'HeaderType' : [ 0xe, ['unsigned char']], 'BIST' : [ 0xf, ['unsigned char']], - 'u' : [ 0x10, ['__unnamed_1734']], + 'u' : [ 0x10, ['__unnamed_1737']], 'DeviceSpecific' : [ 0x40, ['array', 192, ['unsigned char']]], } ], '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { @@ -3912,9 +3912,9 @@ nt_types = { 'Run' : [ 0x8, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], } ], '_SEGMENT_FLAGS' : [ 0x4, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_PI_BUS_EXTENSION' : [ 0x44, { 'Flags' : [ 0x0, ['unsigned long']], @@ -3970,16 +3970,16 @@ nt_types = { 'Initializer' : [ 0x18, ['pointer', ['void']]], } ], '_MMVAD' : [ 0x28, { - 'u1' : [ 0x0, ['__unnamed_151c']], + 'u1' : [ 0x0, ['__unnamed_151e']], 'LeftChild' : [ 0x4, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x8, ['pointer', ['_MMVAD']]], 'StartingVpn' : [ 0xc, ['unsigned long']], 'EndingVpn' : [ 0x10, ['unsigned long']], - 'u' : [ 0x14, ['__unnamed_151f']], + 'u' : [ 0x14, ['__unnamed_1521']], 'ControlArea' : [ 0x18, ['pointer', ['_CONTROL_AREA']]], 'FirstPrototypePte' : [ 0x1c, ['pointer', ['_MMPTE']]], 'LastContiguousPte' : [ 0x20, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x24, ['__unnamed_1522']], + 'u2' : [ 0x24, ['__unnamed_1524']], } ], '_POP_POWER_ACTION' : [ 0x40, { 'Updates' : [ 0x0, ['unsigned char']], @@ -4009,14 +4009,14 @@ nt_types = { 'Request' : [ 0x18, ['_PORT_MESSAGE']], } ], '_MMVAD_SHORT' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_151c']], + 'u1' : [ 0x0, ['__unnamed_151e']], 'LeftChild' : [ 0x4, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x8, ['pointer', ['_MMVAD']]], 'StartingVpn' : [ 0xc, ['unsigned long']], 'EndingVpn' : [ 0x10, ['unsigned long']], - 'u' : [ 0x14, ['__unnamed_151f']], + 'u' : [ 0x14, ['__unnamed_1521']], } ], - '__unnamed_177f' : [ 0x2c, { + '__unnamed_1782' : [ 0x2c, { 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], } ], @@ -4033,7 +4033,7 @@ nt_types = { 'SubjectSecurityContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], 'SecurityDescriptor' : [ 0x2c, ['pointer', ['void']]], 'AuxData' : [ 0x30, ['pointer', ['void']]], - 'Privileges' : [ 0x34, ['__unnamed_177f']], + 'Privileges' : [ 0x34, ['__unnamed_1782']], 'AuditPrivileges' : [ 0x60, ['unsigned char']], 'ObjectName' : [ 0x64, ['_UNICODE_STRING']], 'ObjectTypeName' : [ 0x6c, ['_UNICODE_STRING']], @@ -4049,10 +4049,10 @@ nt_types = { 'Data' : [ 0x20, ['_PLUGPLAY_EVENT_BLOCK']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], } ], '_PNP_DEVICE_EVENT_LIST' : [ 0x4c, { 'Status' : [ 0x0, ['long']], @@ -4065,15 +4065,15 @@ nt_types = { 'SpecialRegisters' : [ 0x2cc, ['_KSPECIAL_REGISTERS']], } ], '_MMPTE_TRANSITION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_STRING' : [ 0x8, { 'Length' : [ 0x0, ['unsigned short']], @@ -4081,15 +4081,15 @@ nt_types = { 'Buffer' : [ 0x4, ['pointer', ['unsigned char']]], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_flags' : [ 0x1, { 'Removable' : [ 0x0, ['unsigned char']], @@ -4108,9 +4108,9 @@ nt_types = { 'DemotePercent' : [ 0xc, ['unsigned char']], 'PromotePercent' : [ 0xd, ['unsigned char']], 'Spare' : [ 0xe, ['array', 2, ['unsigned char']]], - 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_GUID' : [ 0x10, { 'Data1' : [ 0x0, ['unsigned long']], @@ -4298,47 +4298,47 @@ nt_types = { 'Count' : [ 0x0, ['unsigned long']], 'HashKey' : [ 0x4, ['array', 1, ['unsigned long']]], } ], - '__unnamed_1821' : [ 0x10, { + '__unnamed_1824' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'FileAttributes' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'EaLength' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1825' : [ 0x10, { + '__unnamed_1828' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'Parameters' : [ 0xc, ['pointer', ['_NAMED_PIPE_CREATE_PARAMETERS']]], } ], - '__unnamed_1829' : [ 0x10, { + '__unnamed_182c' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'Parameters' : [ 0xc, ['pointer', ['_MAILSLOT_CREATE_PARAMETERS']]], } ], - '__unnamed_182b' : [ 0x10, { + '__unnamed_182e' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'Key' : [ 0x4, ['unsigned long']], 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], } ], - '__unnamed_182f' : [ 0x10, { + '__unnamed_1832' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'FileName' : [ 0x4, ['pointer', ['_UNICODE_STRING']]], 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileMaximumInformation'})]], 'FileIndex' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1831' : [ 0x8, { + '__unnamed_1834' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'CompletionFilter' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1833' : [ 0x8, { + '__unnamed_1836' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileMaximumInformation'})]], } ], - '__unnamed_1835' : [ 0x10, { + '__unnamed_1838' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileMaximumInformation'})]], 'FileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], @@ -4347,207 +4347,207 @@ nt_types = { 'ClusterCount' : [ 0xc, ['unsigned long']], 'DeleteHandle' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1837' : [ 0x10, { + '__unnamed_183a' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'EaList' : [ 0x4, ['pointer', ['void']]], 'EaListLength' : [ 0x8, ['unsigned long']], 'EaIndex' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1839' : [ 0x4, { + '__unnamed_183c' : [ 0x4, { 'Length' : [ 0x0, ['unsigned long']], } ], - '__unnamed_183d' : [ 0x8, { + '__unnamed_1840' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'FsInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsMaximumInformation'})]], } ], - '__unnamed_183f' : [ 0x10, { + '__unnamed_1842' : [ 0x10, { 'OutputBufferLength' : [ 0x0, ['unsigned long']], 'InputBufferLength' : [ 0x4, ['unsigned long']], 'FsControlCode' : [ 0x8, ['unsigned long']], 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1841' : [ 0x10, { + '__unnamed_1844' : [ 0x10, { 'Length' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], 'Key' : [ 0x4, ['unsigned long']], 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], } ], - '__unnamed_1843' : [ 0x10, { + '__unnamed_1846' : [ 0x10, { 'OutputBufferLength' : [ 0x0, ['unsigned long']], 'InputBufferLength' : [ 0x4, ['unsigned long']], 'IoControlCode' : [ 0x8, ['unsigned long']], 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1845' : [ 0x8, { + '__unnamed_1848' : [ 0x8, { 'SecurityInformation' : [ 0x0, ['unsigned long']], 'Length' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1847' : [ 0x8, { + '__unnamed_184a' : [ 0x8, { 'SecurityInformation' : [ 0x0, ['unsigned long']], 'SecurityDescriptor' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_1849' : [ 0x8, { + '__unnamed_184c' : [ 0x8, { 'Vpb' : [ 0x0, ['pointer', ['_VPB']]], 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], } ], - '__unnamed_184d' : [ 0x4, { + '__unnamed_1850' : [ 0x4, { 'Srb' : [ 0x0, ['pointer', ['_SCSI_REQUEST_BLOCK']]], } ], - '__unnamed_1851' : [ 0x10, { + '__unnamed_1854' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'StartSid' : [ 0x4, ['pointer', ['void']]], 'SidList' : [ 0x8, ['pointer', ['_FILE_GET_QUOTA_INFORMATION']]], 'SidListLength' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1855' : [ 0x4, { + '__unnamed_1858' : [ 0x4, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations'})]], } ], - '__unnamed_1857' : [ 0x10, { + '__unnamed_185a' : [ 0x10, { 'InterfaceType' : [ 0x0, ['pointer', ['_GUID']]], 'Size' : [ 0x4, ['unsigned short']], 'Version' : [ 0x6, ['unsigned short']], 'Interface' : [ 0x8, ['pointer', ['_INTERFACE']]], 'InterfaceSpecificData' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_185b' : [ 0x4, { + '__unnamed_185e' : [ 0x4, { 'Capabilities' : [ 0x0, ['pointer', ['_DEVICE_CAPABILITIES']]], } ], - '__unnamed_185d' : [ 0x4, { + '__unnamed_1860' : [ 0x4, { 'IoResourceRequirementList' : [ 0x0, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], } ], - '__unnamed_185f' : [ 0x10, { + '__unnamed_1862' : [ 0x10, { 'WhichSpace' : [ 0x0, ['unsigned long']], 'Buffer' : [ 0x4, ['pointer', ['void']]], 'Offset' : [ 0x8, ['unsigned long']], 'Length' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1861' : [ 0x1, { + '__unnamed_1864' : [ 0x1, { 'Lock' : [ 0x0, ['unsigned char']], } ], - '__unnamed_1865' : [ 0x4, { + '__unnamed_1868' : [ 0x4, { 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber'})]], } ], - '__unnamed_1869' : [ 0x8, { + '__unnamed_186c' : [ 0x8, { 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], 'LocaleId' : [ 0x4, ['unsigned long']], } ], - '__unnamed_186d' : [ 0x8, { + '__unnamed_1870' : [ 0x8, { 'InPath' : [ 0x0, ['unsigned char']], 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile'})]], } ], - '__unnamed_186f' : [ 0x4, { + '__unnamed_1872' : [ 0x4, { 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], } ], - '__unnamed_1873' : [ 0x4, { + '__unnamed_1876' : [ 0x4, { 'PowerSequence' : [ 0x0, ['pointer', ['_POWER_SEQUENCE']]], } ], - '__unnamed_1877' : [ 0x10, { + '__unnamed_187a' : [ 0x10, { 'SystemContext' : [ 0x0, ['unsigned long']], 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], 'State' : [ 0x8, ['_POWER_STATE']], 'ShutdownType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], } ], - '__unnamed_1879' : [ 0x8, { + '__unnamed_187c' : [ 0x8, { 'AllocatedResources' : [ 0x0, ['pointer', ['_CM_RESOURCE_LIST']]], 'AllocatedResourcesTranslated' : [ 0x4, ['pointer', ['_CM_RESOURCE_LIST']]], } ], - '__unnamed_187b' : [ 0x10, { + '__unnamed_187e' : [ 0x10, { 'ProviderId' : [ 0x0, ['unsigned long']], 'DataPath' : [ 0x4, ['pointer', ['void']]], 'BufferSize' : [ 0x8, ['unsigned long']], 'Buffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_187d' : [ 0x10, { + '__unnamed_1880' : [ 0x10, { 'Argument1' : [ 0x0, ['pointer', ['void']]], 'Argument2' : [ 0x4, ['pointer', ['void']]], 'Argument3' : [ 0x8, ['pointer', ['void']]], 'Argument4' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_187f' : [ 0x10, { - 'Create' : [ 0x0, ['__unnamed_1821']], - 'CreatePipe' : [ 0x0, ['__unnamed_1825']], - 'CreateMailslot' : [ 0x0, ['__unnamed_1829']], - 'Read' : [ 0x0, ['__unnamed_182b']], - 'Write' : [ 0x0, ['__unnamed_182b']], - 'QueryDirectory' : [ 0x0, ['__unnamed_182f']], - 'NotifyDirectory' : [ 0x0, ['__unnamed_1831']], - 'QueryFile' : [ 0x0, ['__unnamed_1833']], - 'SetFile' : [ 0x0, ['__unnamed_1835']], - 'QueryEa' : [ 0x0, ['__unnamed_1837']], - 'SetEa' : [ 0x0, ['__unnamed_1839']], - 'QueryVolume' : [ 0x0, ['__unnamed_183d']], - 'SetVolume' : [ 0x0, ['__unnamed_183d']], - 'FileSystemControl' : [ 0x0, ['__unnamed_183f']], - 'LockControl' : [ 0x0, ['__unnamed_1841']], - 'DeviceIoControl' : [ 0x0, ['__unnamed_1843']], - 'QuerySecurity' : [ 0x0, ['__unnamed_1845']], - 'SetSecurity' : [ 0x0, ['__unnamed_1847']], - 'MountVolume' : [ 0x0, ['__unnamed_1849']], - 'VerifyVolume' : [ 0x0, ['__unnamed_1849']], - 'Scsi' : [ 0x0, ['__unnamed_184d']], - 'QueryQuota' : [ 0x0, ['__unnamed_1851']], - 'SetQuota' : [ 0x0, ['__unnamed_1839']], - 'QueryDeviceRelations' : [ 0x0, ['__unnamed_1855']], - 'QueryInterface' : [ 0x0, ['__unnamed_1857']], - 'DeviceCapabilities' : [ 0x0, ['__unnamed_185b']], - 'FilterResourceRequirements' : [ 0x0, ['__unnamed_185d']], - 'ReadWriteConfig' : [ 0x0, ['__unnamed_185f']], - 'SetLock' : [ 0x0, ['__unnamed_1861']], - 'QueryId' : [ 0x0, ['__unnamed_1865']], - 'QueryDeviceText' : [ 0x0, ['__unnamed_1869']], - 'UsageNotification' : [ 0x0, ['__unnamed_186d']], - 'WaitWake' : [ 0x0, ['__unnamed_186f']], - 'PowerSequence' : [ 0x0, ['__unnamed_1873']], - 'Power' : [ 0x0, ['__unnamed_1877']], - 'StartDevice' : [ 0x0, ['__unnamed_1879']], - 'WMI' : [ 0x0, ['__unnamed_187b']], - 'Others' : [ 0x0, ['__unnamed_187d']], + '__unnamed_1882' : [ 0x10, { + 'Create' : [ 0x0, ['__unnamed_1824']], + 'CreatePipe' : [ 0x0, ['__unnamed_1828']], + 'CreateMailslot' : [ 0x0, ['__unnamed_182c']], + 'Read' : [ 0x0, ['__unnamed_182e']], + 'Write' : [ 0x0, ['__unnamed_182e']], + 'QueryDirectory' : [ 0x0, ['__unnamed_1832']], + 'NotifyDirectory' : [ 0x0, ['__unnamed_1834']], + 'QueryFile' : [ 0x0, ['__unnamed_1836']], + 'SetFile' : [ 0x0, ['__unnamed_1838']], + 'QueryEa' : [ 0x0, ['__unnamed_183a']], + 'SetEa' : [ 0x0, ['__unnamed_183c']], + 'QueryVolume' : [ 0x0, ['__unnamed_1840']], + 'SetVolume' : [ 0x0, ['__unnamed_1840']], + 'FileSystemControl' : [ 0x0, ['__unnamed_1842']], + 'LockControl' : [ 0x0, ['__unnamed_1844']], + 'DeviceIoControl' : [ 0x0, ['__unnamed_1846']], + 'QuerySecurity' : [ 0x0, ['__unnamed_1848']], + 'SetSecurity' : [ 0x0, ['__unnamed_184a']], + 'MountVolume' : [ 0x0, ['__unnamed_184c']], + 'VerifyVolume' : [ 0x0, ['__unnamed_184c']], + 'Scsi' : [ 0x0, ['__unnamed_1850']], + 'QueryQuota' : [ 0x0, ['__unnamed_1854']], + 'SetQuota' : [ 0x0, ['__unnamed_183c']], + 'QueryDeviceRelations' : [ 0x0, ['__unnamed_1858']], + 'QueryInterface' : [ 0x0, ['__unnamed_185a']], + 'DeviceCapabilities' : [ 0x0, ['__unnamed_185e']], + 'FilterResourceRequirements' : [ 0x0, ['__unnamed_1860']], + 'ReadWriteConfig' : [ 0x0, ['__unnamed_1862']], + 'SetLock' : [ 0x0, ['__unnamed_1864']], + 'QueryId' : [ 0x0, ['__unnamed_1868']], + 'QueryDeviceText' : [ 0x0, ['__unnamed_186c']], + 'UsageNotification' : [ 0x0, ['__unnamed_1870']], + 'WaitWake' : [ 0x0, ['__unnamed_1872']], + 'PowerSequence' : [ 0x0, ['__unnamed_1876']], + 'Power' : [ 0x0, ['__unnamed_187a']], + 'StartDevice' : [ 0x0, ['__unnamed_187c']], + 'WMI' : [ 0x0, ['__unnamed_187e']], + 'Others' : [ 0x0, ['__unnamed_1880']], } ], '_IO_STACK_LOCATION' : [ 0x24, { 'MajorFunction' : [ 0x0, ['unsigned char']], 'MinorFunction' : [ 0x1, ['unsigned char']], 'Flags' : [ 0x2, ['unsigned char']], 'Control' : [ 0x3, ['unsigned char']], - 'Parameters' : [ 0x4, ['__unnamed_187f']], + 'Parameters' : [ 0x4, ['__unnamed_1882']], 'DeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], 'FileObject' : [ 0x18, ['pointer', ['_FILE_OBJECT']]], 'CompletionRoutine' : [ 0x1c, ['pointer', ['void']]], 'Context' : [ 0x20, ['pointer', ['void']]], } ], - '__unnamed_1886' : [ 0x18, { + '__unnamed_1889' : [ 0x18, { 'Length' : [ 0x0, ['unsigned long']], 'Alignment' : [ 0x4, ['unsigned long']], 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], } ], - '__unnamed_1888' : [ 0x8, { + '__unnamed_188b' : [ 0x8, { 'MinimumVector' : [ 0x0, ['unsigned long']], 'MaximumVector' : [ 0x4, ['unsigned long']], } ], - '__unnamed_188a' : [ 0x8, { + '__unnamed_188d' : [ 0x8, { 'MinimumChannel' : [ 0x0, ['unsigned long']], 'MaximumChannel' : [ 0x4, ['unsigned long']], } ], - '__unnamed_188c' : [ 0x10, { + '__unnamed_188f' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'MinBusNumber' : [ 0x4, ['unsigned long']], 'MaxBusNumber' : [ 0x8, ['unsigned long']], 'Reserved' : [ 0xc, ['unsigned long']], } ], - '__unnamed_188e' : [ 0xc, { + '__unnamed_1891' : [ 0xc, { 'Priority' : [ 0x0, ['unsigned long']], 'Reserved1' : [ 0x4, ['unsigned long']], 'Reserved2' : [ 0x8, ['unsigned long']], } ], - '__unnamed_1890' : [ 0x18, { - 'Port' : [ 0x0, ['__unnamed_1886']], - 'Memory' : [ 0x0, ['__unnamed_1886']], - 'Interrupt' : [ 0x0, ['__unnamed_1888']], - 'Dma' : [ 0x0, ['__unnamed_188a']], - 'Generic' : [ 0x0, ['__unnamed_1886']], - 'DevicePrivate' : [ 0x0, ['__unnamed_15db']], - 'BusNumber' : [ 0x0, ['__unnamed_188c']], - 'ConfigData' : [ 0x0, ['__unnamed_188e']], + '__unnamed_1893' : [ 0x18, { + 'Port' : [ 0x0, ['__unnamed_1889']], + 'Memory' : [ 0x0, ['__unnamed_1889']], + 'Interrupt' : [ 0x0, ['__unnamed_188b']], + 'Dma' : [ 0x0, ['__unnamed_188d']], + 'Generic' : [ 0x0, ['__unnamed_1889']], + 'DevicePrivate' : [ 0x0, ['__unnamed_15de']], + 'BusNumber' : [ 0x0, ['__unnamed_188f']], + 'ConfigData' : [ 0x0, ['__unnamed_1891']], } ], '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { 'Option' : [ 0x0, ['unsigned char']], @@ -4556,7 +4556,7 @@ nt_types = { 'Spare1' : [ 0x3, ['unsigned char']], 'Flags' : [ 0x4, ['unsigned short']], 'Spare2' : [ 0x6, ['unsigned short']], - 'u' : [ 0x8, ['__unnamed_1890']], + 'u' : [ 0x8, ['__unnamed_1893']], } ], '_MI_VERIFIER_POOL_HEADER' : [ 0x4, { 'VerifierPoolEntry' : [ 0x0, ['pointer', ['_VI_POOL_ENTRY']]], @@ -4570,25 +4570,25 @@ nt_types = { 'CallerAddress' : [ 0x14, ['array', 10, ['pointer', ['void']]]], 'KeyBodyList' : [ 0x3c, ['_LIST_ENTRY']], } ], - '__unnamed_189f' : [ 0x4, { + '__unnamed_18a2' : [ 0x4, { 'DataLength' : [ 0x0, ['short']], 'TotalLength' : [ 0x2, ['short']], } ], - '__unnamed_18a1' : [ 0x4, { - 's1' : [ 0x0, ['__unnamed_189f']], + '__unnamed_18a4' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_18a2']], 'Length' : [ 0x0, ['unsigned long']], } ], - '__unnamed_18a3' : [ 0x4, { + '__unnamed_18a6' : [ 0x4, { 'Type' : [ 0x0, ['short']], 'DataInfoOffset' : [ 0x2, ['short']], } ], - '__unnamed_18a5' : [ 0x4, { - 's2' : [ 0x0, ['__unnamed_18a3']], + '__unnamed_18a8' : [ 0x4, { + 's2' : [ 0x0, ['__unnamed_18a6']], 'ZeroInit' : [ 0x0, ['unsigned long']], } ], '_PORT_MESSAGE' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_18a1']], - 'u2' : [ 0x4, ['__unnamed_18a5']], + 'u1' : [ 0x0, ['__unnamed_18a4']], + 'u2' : [ 0x4, ['__unnamed_18a8']], 'ClientId' : [ 0x8, ['_CLIENT_ID']], 'DoNotUseThisField' : [ 0x8, ['double']], 'MessageId' : [ 0x10, ['unsigned long']], @@ -4732,17 +4732,17 @@ nt_types = { 'Parameter3' : [ 0xc, ['unsigned long']], 'Parameter4' : [ 0x10, ['unsigned long']], } ], - '__unnamed_18e2' : [ 0x4, { - 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32)]], + '__unnamed_18e5' : [ 0x4, { + 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], } ], - '__unnamed_18e4' : [ 0x4, { - 'bits' : [ 0x0, ['__unnamed_18e2']], + '__unnamed_18e7' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_18e5']], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_PCI_SLOT_NUMBER' : [ 0x4, { - 'u' : [ 0x0, ['__unnamed_18e4']], + 'u' : [ 0x0, ['__unnamed_18e7']], } ], '_Wx86ThreadState' : [ 0xc, { 'CallBx86Eip' : [ 0x0, ['pointer', ['unsigned long']]], @@ -4755,9 +4755,9 @@ nt_types = { 'PostList' : [ 0x8, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x10, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x14, ['pointer', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_SID' : [ 0xc, { @@ -4834,50 +4834,50 @@ nt_types = { 'FsFilterCallbacks' : [ 0x18, ['pointer', ['_FS_FILTER_CALLBACKS']]], } ], '_PM_SUPPORT' : [ 0x1, { - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_TEB_ACTIVE_FRAME_CONTEXT' : [ 0x8, { 'Flags' : [ 0x0, ['unsigned long']], 'FrameName' : [ 0x4, ['pointer', ['unsigned char']]], } ], - '__unnamed_1917' : [ 0xc, { + '__unnamed_191a' : [ 0xc, { 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], 'AllocateFromCount' : [ 0x4, ['unsigned long']], 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], } ], - '__unnamed_1919' : [ 0x4, { + '__unnamed_191c' : [ 0x4, { 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], } ], - '__unnamed_191d' : [ 0x4, { + '__unnamed_1920' : [ 0x4, { 'AllocatedResources' : [ 0x0, ['pointer', ['pointer', ['_CM_PARTIAL_RESOURCE_LIST']]]], } ], - '__unnamed_191f' : [ 0x10, { + '__unnamed_1922' : [ 0x10, { 'PhysicalDeviceObject' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], 'ConflictingResource' : [ 0x4, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], 'ConflictCount' : [ 0x8, ['pointer', ['unsigned long']]], 'Conflicts' : [ 0xc, ['pointer', ['pointer', ['_ARBITER_CONFLICT_INFO']]]], } ], - '__unnamed_1921' : [ 0x4, { + '__unnamed_1924' : [ 0x4, { 'ReserveDevice' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], } ], - '__unnamed_1923' : [ 0x10, { - 'TestAllocation' : [ 0x0, ['__unnamed_1917']], - 'RetestAllocation' : [ 0x0, ['__unnamed_1917']], - 'BootAllocation' : [ 0x0, ['__unnamed_1919']], - 'QueryAllocatedResources' : [ 0x0, ['__unnamed_191d']], - 'QueryConflict' : [ 0x0, ['__unnamed_191f']], - 'QueryArbitrate' : [ 0x0, ['__unnamed_1919']], - 'AddReserved' : [ 0x0, ['__unnamed_1921']], + '__unnamed_1926' : [ 0x10, { + 'TestAllocation' : [ 0x0, ['__unnamed_191a']], + 'RetestAllocation' : [ 0x0, ['__unnamed_191a']], + 'BootAllocation' : [ 0x0, ['__unnamed_191c']], + 'QueryAllocatedResources' : [ 0x0, ['__unnamed_1920']], + 'QueryConflict' : [ 0x0, ['__unnamed_1922']], + 'QueryArbitrate' : [ 0x0, ['__unnamed_191c']], + 'AddReserved' : [ 0x0, ['__unnamed_1924']], } ], '_ARBITER_PARAMETERS' : [ 0x10, { - 'Parameters' : [ 0x0, ['__unnamed_1923']], + 'Parameters' : [ 0x0, ['__unnamed_1926']], } ], '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { 'AuditMask' : [ 0x0, ['unsigned long']], @@ -4955,25 +4955,25 @@ nt_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -5003,47 +5003,47 @@ nt_types = { 'ContentionCount' : [ 0x14, ['unsigned long']], 'Spare' : [ 0x18, ['array', 2, ['unsigned long']]], } ], - '__unnamed_1946' : [ 0x14, { + '__unnamed_1949' : [ 0x14, { 'ClassGuid' : [ 0x0, ['_GUID']], 'SymbolicLinkName' : [ 0x10, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1948' : [ 0x2, { + '__unnamed_194b' : [ 0x2, { 'DeviceIds' : [ 0x0, ['array', 1, ['unsigned short']]], } ], - '__unnamed_194a' : [ 0x2, { + '__unnamed_194d' : [ 0x2, { 'DeviceId' : [ 0x0, ['array', 1, ['unsigned short']]], } ], - '__unnamed_194c' : [ 0x8, { + '__unnamed_194f' : [ 0x8, { 'NotificationStructure' : [ 0x0, ['pointer', ['void']]], 'DeviceIds' : [ 0x4, ['array', 1, ['unsigned short']]], } ], - '__unnamed_194e' : [ 0x4, { + '__unnamed_1951' : [ 0x4, { 'Notification' : [ 0x0, ['pointer', ['void']]], } ], - '__unnamed_1950' : [ 0x8, { + '__unnamed_1953' : [ 0x8, { 'NotificationCode' : [ 0x0, ['unsigned long']], 'NotificationData' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1952' : [ 0x8, { + '__unnamed_1955' : [ 0x8, { 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1954' : [ 0x10, { + '__unnamed_1957' : [ 0x10, { 'BlockedDriverGuid' : [ 0x0, ['_GUID']], } ], - '__unnamed_1956' : [ 0x2, { + '__unnamed_1959' : [ 0x2, { 'ParentId' : [ 0x0, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1958' : [ 0x14, { - 'DeviceClass' : [ 0x0, ['__unnamed_1946']], - 'TargetDevice' : [ 0x0, ['__unnamed_1948']], - 'InstallDevice' : [ 0x0, ['__unnamed_194a']], - 'CustomNotification' : [ 0x0, ['__unnamed_194c']], - 'ProfileNotification' : [ 0x0, ['__unnamed_194e']], - 'PowerNotification' : [ 0x0, ['__unnamed_1950']], - 'VetoNotification' : [ 0x0, ['__unnamed_1952']], - 'BlockedDriverNotification' : [ 0x0, ['__unnamed_1954']], - 'InvalidIDNotification' : [ 0x0, ['__unnamed_1956']], + '__unnamed_195b' : [ 0x14, { + 'DeviceClass' : [ 0x0, ['__unnamed_1949']], + 'TargetDevice' : [ 0x0, ['__unnamed_194b']], + 'InstallDevice' : [ 0x0, ['__unnamed_194d']], + 'CustomNotification' : [ 0x0, ['__unnamed_194f']], + 'ProfileNotification' : [ 0x0, ['__unnamed_1951']], + 'PowerNotification' : [ 0x0, ['__unnamed_1953']], + 'VetoNotification' : [ 0x0, ['__unnamed_1955']], + 'BlockedDriverNotification' : [ 0x0, ['__unnamed_1957']], + 'InvalidIDNotification' : [ 0x0, ['__unnamed_1959']], } ], '_PLUGPLAY_EVENT_BLOCK' : [ 0x38, { 'EventGuid' : [ 0x0, ['_GUID']], @@ -5052,7 +5052,7 @@ nt_types = { 'Flags' : [ 0x18, ['unsigned long']], 'TotalSize' : [ 0x1c, ['unsigned long']], 'DeviceObject' : [ 0x20, ['pointer', ['void']]], - 'u' : [ 0x24, ['__unnamed_1958']], + 'u' : [ 0x24, ['__unnamed_195b']], } ], '_CACHED_CHILD_LIST' : [ 0x8, { 'Count' : [ 0x0, ['unsigned long']], @@ -5063,16 +5063,16 @@ nt_types = { 'Range' : [ 0x0, ['_PO_MEMORY_RANGE_ARRAY_RANGE']], 'Link' : [ 0x0, ['_PO_MEMORY_RANGE_ARRAY_LINK']], } ], - '__unnamed_196f' : [ 0x8, { + '__unnamed_1972' : [ 0x8, { 'Signature' : [ 0x0, ['unsigned long']], 'CheckSum' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1971' : [ 0x10, { + '__unnamed_1974' : [ 0x10, { 'DiskId' : [ 0x0, ['_GUID']], } ], - '__unnamed_1973' : [ 0x10, { - 'Mbr' : [ 0x0, ['__unnamed_196f']], - 'Gpt' : [ 0x0, ['__unnamed_1971']], + '__unnamed_1976' : [ 0x10, { + 'Mbr' : [ 0x0, ['__unnamed_1972']], + 'Gpt' : [ 0x0, ['__unnamed_1974']], } ], '_DUMP_INITIALIZATION_CONTEXT' : [ 0x70, { 'Length' : [ 0x0, ['unsigned long']], @@ -5093,7 +5093,7 @@ nt_types = { 'TargetAddress' : [ 0x50, ['pointer', ['void']]], 'WritePendingRoutine' : [ 0x54, ['pointer', ['void']]], 'PartitionStyle' : [ 0x58, ['unsigned long']], - 'DiskInfo' : [ 0x5c, ['__unnamed_1973']], + 'DiskInfo' : [ 0x5c, ['__unnamed_1976']], } ], '_IO_CLIENT_EXTENSION' : [ 0x8, { 'NextExtension' : [ 0x0, ['pointer', ['_IO_CLIENT_EXTENSION']]], @@ -5190,7 +5190,7 @@ nt_types = { 'ReadyS0' : [ 0x38, ['_LIST_ENTRY']], 'WaitS0' : [ 0x40, ['_LIST_ENTRY']], } ], - '__unnamed_19a3' : [ 0x8, { + '__unnamed_19a6' : [ 0x8, { 'Base' : [ 0x0, ['unsigned long']], 'Limit' : [ 0x4, ['unsigned long']], } ], @@ -5203,7 +5203,7 @@ nt_types = { 'SecondaryBus' : [ 0x9, ['unsigned char']], 'SubordinateBus' : [ 0xa, ['unsigned char']], 'SecondaryLatency' : [ 0xb, ['unsigned char']], - 'Range' : [ 0xc, ['array', 4, ['__unnamed_19a3']]], + 'Range' : [ 0xc, ['array', 4, ['__unnamed_19a6']]], 'InterruptLine' : [ 0x2c, ['unsigned char']], 'InterruptPin' : [ 0x2d, ['unsigned char']], 'BridgeControl' : [ 0x2e, ['unsigned short']], @@ -5467,18 +5467,18 @@ nt_types = { 'ModifiedId' : [ 0x10, ['_LUID']], 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], } ], - '__unnamed_1a31' : [ 0x8, { + '__unnamed_1a34' : [ 0x8, { 'EndingOffset' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], 'ResourceToRelease' : [ 0x4, ['pointer', ['pointer', ['_ERESOURCE']]]], } ], - '__unnamed_1a33' : [ 0x4, { + '__unnamed_1a36' : [ 0x4, { 'ResourceToRelease' : [ 0x0, ['pointer', ['_ERESOURCE']]], } ], - '__unnamed_1a37' : [ 0x8, { + '__unnamed_1a3a' : [ 0x8, { 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], 'PageProtection' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1a39' : [ 0x14, { + '__unnamed_1a3c' : [ 0x14, { 'Argument1' : [ 0x0, ['pointer', ['void']]], 'Argument2' : [ 0x4, ['pointer', ['void']]], 'Argument3' : [ 0x8, ['pointer', ['void']]], @@ -5486,10 +5486,10 @@ nt_types = { 'Argument5' : [ 0x10, ['pointer', ['void']]], } ], '_FS_FILTER_PARAMETERS' : [ 0x14, { - 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_1a31']], - 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_1a33']], - 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_1a37']], - 'Others' : [ 0x0, ['__unnamed_1a39']], + 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_1a34']], + 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_1a36']], + 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_1a3a']], + 'Others' : [ 0x0, ['__unnamed_1a3c']], } ], '_COMPRESSED_DATA_INFO' : [ 0xc, { 'CompressionFormatAndEngine' : [ 0x0, ['unsigned short']], diff --git a/volatility/plugins/overlays/windows/win2003_sp1_x64_vtypes.py b/volatility/plugins/overlays/windows/win2003_sp1_x64_vtypes.py index 3bd31a56..5aa718c2 100644 --- a/volatility/plugins/overlays/windows/win2003_sp1_x64_vtypes.py +++ b/volatility/plugins/overlays/windows/win2003_sp1_x64_vtypes.py @@ -232,9 +232,9 @@ ntkrnlmp_types = { 'Teb' : [ 0xb0, ['pointer64', ['void']]], 'Timer' : [ 0xb8, ['_KTIMER']], 'TimerFill' : [ 0xb8, ['array', 60, ['unsigned char']]], - 'AutoAlignment' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReservedFlags' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'AutoAlignment' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'ReservedFlags' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='long')]], 'ThreadFlags' : [ 0xf4, ['long']], 'WaitBlock' : [ 0xf8, ['array', 4, ['_KWAIT_BLOCK']]], 'WaitBlockFill0' : [ 0xf8, ['array', 43, ['unsigned char']]], @@ -377,15 +377,15 @@ ntkrnlmp_types = { } ], '_EX_FAST_REF' : [ 0x8, { 'Object' : [ 0x0, ['pointer64', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], } ], '_EX_PUSH_LOCK' : [ 0x8, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], 'Ptr' : [ 0x0, ['pointer64', ['void']]], } ], @@ -435,31 +435,31 @@ ntkrnlmp_types = { 'ReadClusterSize' : [ 0x40c, ['unsigned long']], 'GrantedAccess' : [ 0x410, ['unsigned long']], 'CrossThreadFlags' : [ 0x414, ['unsigned long']], - 'Terminated' : [ 0x414, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeadThread' : [ 0x414, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x414, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x414, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x414, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x414, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x414, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x414, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x414, ['BitField', dict(start_bit = 8, end_bit = 9)]], + 'Terminated' : [ 0x414, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeadThread' : [ 0x414, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x414, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x414, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x414, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x414, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x414, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x414, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x414, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x418, ['unsigned long']], - 'ActiveExWorker' : [ 0x418, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x418, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x418, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'KeyedEventInUse' : [ 0x418, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'ActiveExWorker' : [ 0x418, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x418, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x418, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x418, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x41c, ['unsigned long']], - 'LpcReceivedMsgIdValid' : [ 0x41c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LpcExitThreadCalled' : [ 0x41c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'AddressSpaceOwner' : [ 0x41c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x41c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x41c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemWorkingSetExclusive' : [ 0x41c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemWorkingSetShared' : [ 0x41c, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x41c, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x41d, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ApcNeeded' : [ 0x41d, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'LpcReceivedMsgIdValid' : [ 0x41c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'LpcExitThreadCalled' : [ 0x41c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'AddressSpaceOwner' : [ 0x41c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x41c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x41c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemWorkingSetExclusive' : [ 0x41c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemWorkingSetShared' : [ 0x41c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x41c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x41d, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ApcNeeded' : [ 0x41d, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], 'ForwardClusterOnly' : [ 0x420, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x421, ['unsigned char']], 'ActiveFaultCount' : [ 0x422, ['unsigned char']], @@ -534,35 +534,35 @@ ntkrnlmp_types = { 'ModifiedPageCount' : [ 0x380, ['unsigned long']], 'JobStatus' : [ 0x384, ['unsigned long']], 'Flags' : [ 0x388, ['unsigned long']], - 'CreateReported' : [ 0x388, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x388, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x388, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x388, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x388, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x388, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x388, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x388, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x388, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x388, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x388, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x388, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x388, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'SessionCreationUnderway' : [ 0x388, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x388, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x388, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x388, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x388, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x388, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x388, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x388, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x388, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x388, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x388, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'SmapAllowed' : [ 0x388, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'CreateFailed' : [ 0x388, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x388, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'Spare1' : [ 0x388, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'Spare2' : [ 0x388, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x388, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x388, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x388, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x388, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x388, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x388, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x388, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x388, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x388, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x388, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x388, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x388, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x388, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'SessionCreationUnderway' : [ 0x388, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x388, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x388, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x388, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x388, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x388, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x388, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x388, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x388, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x388, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x388, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SmapAllowed' : [ 0x388, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'CreateFailed' : [ 0x388, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x388, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'Spare1' : [ 0x388, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Spare2' : [ 0x388, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x38c, ['long']], 'NextPageColor' : [ 0x390, ['unsigned short']], 'SubSystemMinorVersion' : [ 0x392, ['unsigned char']], @@ -682,12 +682,12 @@ ntkrnlmp_types = { } ], '__unnamed_117b' : [ 0x8, { 'EntireFrame' : [ 0x0, ['unsigned long long']], - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 57)]], - 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58)]], - 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 60)]], - 'Priority' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 63)]], - 'MustBeCached' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 57, native_type='unsigned long long')]], + 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58, native_type='unsigned long long')]], + 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 60, native_type='unsigned long long')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 63, native_type='unsigned long long')]], + 'MustBeCached' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_MMPFN' : [ 0x30, { 'u1' : [ 0x0, ['__unnamed_116c']], @@ -700,7 +700,7 @@ ntkrnlmp_types = { 'u4' : [ 0x28, ['__unnamed_117b']], } ], '__unnamed_1182' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMVAD']]], } ], '__unnamed_1185' : [ 0x8, { @@ -725,9 +725,9 @@ ntkrnlmp_types = { } ], '_MM_AVL_TABLE' : [ 0x40, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'NodeHint' : [ 0x30, ['pointer64', ['void']]], 'NodeFreeHint' : [ 0x38, ['pointer64', ['void']]], } ], @@ -761,10 +761,10 @@ ntkrnlmp_types = { 'Entry' : [ 0x40, ['array', 2, ['pointer64', ['_MMMOD_WRITER_MDL_ENTRY']]]], 'PageFileName' : [ 0x50, ['_UNICODE_STRING']], 'Bitmap' : [ 0x60, ['pointer64', ['_RTL_BITMAP']]], - 'PageFileNumber' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'ReferenceCount' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'BootPartition' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Reserved' : [ 0x68, ['BitField', dict(start_bit = 9, end_bit = 32)]], + 'PageFileNumber' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'ReferenceCount' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'BootPartition' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Reserved' : [ 0x68, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], 'FileHandle' : [ 0x70, ['pointer64', ['void']]], } ], '_EXCEPTION_RECORD64' : [ 0x98, { @@ -1460,13 +1460,13 @@ ntkrnlmp_types = { 'NextHandleNeedingPool' : [ 0x64, ['unsigned long']], 'HandleCount' : [ 0x68, ['long']], 'Flags' : [ 0x6c, ['unsigned long']], - 'StrictFIFO' : [ 0x6c, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x6c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], } ], '_POOL_HEADER' : [ 0x10, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'ProcessBilled' : [ 0x8, ['pointer64', ['_EPROCESS']]], @@ -1474,15 +1474,15 @@ ntkrnlmp_types = { 'PoolTagHash' : [ 0xa, ['unsigned short']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_TEB_ACTIVE_FRAME' : [ 0x18, { 'Flags' : [ 0x0, ['unsigned long']], @@ -1518,13 +1518,13 @@ ntkrnlmp_types = { 'SpareLong' : [ 0x2c, ['long']], } ], '_MMPTE_PROTOTYPE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_MMSUPPORT' : [ 0x58, { 'WorkingSetExpansionLinks' : [ 0x0, ['_LIST_ENTRY']], @@ -1552,14 +1552,14 @@ ntkrnlmp_types = { 'Info' : [ 0x50, ['EX_QUEUE_WORKER_INFO']], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20)]], - 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20, native_type='unsigned long')]], + 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], } ], '_HEAP_TAG_ENTRY' : [ 0x48, { 'Allocs' : [ 0x0, ['unsigned long']], @@ -1711,22 +1711,22 @@ ntkrnlmp_types = { 'Characteristics' : [ 0x12, ['unsigned short']], } ], '_MMPTE_HARDWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Writable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Writable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x10, { 'Port' : [ 0x0, ['pointer64', ['void']]], @@ -1748,38 +1748,38 @@ ntkrnlmp_types = { 'ContextFlags' : [ 0x0, ['unsigned long']], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'filler' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'filler' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_DEFERRED_WRITE' : [ 0x50, { 'NodeTypeCode' : [ 0x0, ['short']], @@ -1809,13 +1809,13 @@ ntkrnlmp_types = { 'Allocate' : [ 0x2a, ['unsigned char']], } ], '_MMVAD_FLAGS' : [ 0x8, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51, native_type='unsigned long long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63, native_type='unsigned long long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_KSPIN_LOCK_QUEUE' : [ 0x10, { 'Next' : [ 0x0, ['pointer64', ['_KSPIN_LOCK_QUEUE']]], @@ -1900,8 +1900,8 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['unsigned long long']], 'ImageBaseAddress' : [ 0x10, ['unsigned long long']], 'Ldr' : [ 0x18, ['unsigned long long']], @@ -2034,10 +2034,10 @@ ntkrnlmp_types = { 'ThreadListHead' : [ 0x70, ['_LIST_ENTRY']], 'ProcessLock' : [ 0x80, ['unsigned long long']], 'Affinity' : [ 0x88, ['unsigned long long']], - 'AutoAlignment' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ReservedFlags' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'AutoAlignment' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ReservedFlags' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='long')]], 'ProcessFlags' : [ 0x90, ['long']], 'BasePriority' : [ 0x94, ['unsigned char']], 'QuantumReset' : [ 0x95, ['unsigned char']], @@ -2103,8 +2103,8 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['pointer64', ['void']]], 'ImageBaseAddress' : [ 0x10, ['pointer64', ['void']]], 'Ldr' : [ 0x18, ['pointer64', ['_PEB_LDR_DATA']]], @@ -2191,14 +2191,14 @@ ntkrnlmp_types = { 'FrameName' : [ 0x8, ['pointer64', ['unsigned char']]], } ], '_MMPTE_SOFTWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { 'ListSize' : [ 0x0, ['unsigned long']], @@ -2390,16 +2390,16 @@ ntkrnlmp_types = { 'DataValueHigh' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11)]], - 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned short')]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11, native_type='unsigned short')]], + 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14, native_type='unsigned short')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned short')]], + 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], } ], '_IO_COUNTERS' : [ 0x30, { 'ReadOperationCount' : [ 0x0, ['unsigned long long']], @@ -2433,24 +2433,24 @@ ntkrnlmp_types = { 'Volume' : [ 0x70, ['_LIST_ENTRY']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Available0' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'MemoryPriority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'GrowWsleHash' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AcquiredUnsafe' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Available' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Available0' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'GrowWsleHash' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'AcquiredUnsafe' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Available' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'PROCESSOR_PERF_STATE' : [ 0x20, { @@ -2548,8 +2548,8 @@ ntkrnlmp_types = { 'Revision' : [ 0x0, ['unsigned long']], 'DynamicThrottle' : [ 0x4, ['unsigned char']], 'Spare' : [ 0x5, ['array', 3, ['unsigned char']]], - 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'PolicyCount' : [ 0xc, ['unsigned long']], 'Policy' : [ 0x10, ['array', 3, ['_PROCESSOR_POWER_POLICY_INFO']]], } ], @@ -2698,14 +2698,14 @@ ntkrnlmp_types = { '_tmpfname' : [ 0x28, ['pointer64', ['unsigned char']]], } ], '_MMPTE_LIST' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_CMHIVE' : [ 0xab8, { 'Hive' : [ 0x0, ['_HHIVE']], @@ -2806,9 +2806,9 @@ ntkrnlmp_types = { 'Name' : [ 0x10, ['array', 1, ['unsigned short']]], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x1c, { 'Version' : [ 0x0, ['unsigned short']], @@ -2874,8 +2874,8 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['unsigned long']], 'ImageBaseAddress' : [ 0x8, ['unsigned long']], 'Ldr' : [ 0xc, ['unsigned long']], @@ -2979,8 +2979,8 @@ ntkrnlmp_types = { 'DeviceListHead' : [ 0x8, ['_LIST_ENTRY']], 'Lock' : [ 0x18, ['unsigned long long']], 'Busy' : [ 0x20, ['unsigned char']], - 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='long long')]], + 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='long long')]], } ], '_KUSER_SHARED_DATA' : [ 0x378, { 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], @@ -3074,13 +3074,13 @@ ntkrnlmp_types = { 'u4' : [ 0x60, ['__unnamed_15e1']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], } ], '_POOL_DESCRIPTOR' : [ 0x1048, { 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], @@ -3098,22 +3098,22 @@ ntkrnlmp_types = { 'ListHeads' : [ 0x48, ['array', 256, ['_LIST_ENTRY']]], } ], '_HARDWARE_PTE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_WOW64_PROCESS' : [ 0x8, { 'Wow64' : [ 0x0, ['pointer64', ['void']]], @@ -3206,8 +3206,8 @@ ntkrnlmp_types = { 'Handler' : [ 0x8, ['pointer64', ['void']]], } ], '_SEP_AUDIT_POLICY_OVERLAY' : [ 0x8, { - 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36)]], - 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37)]], + 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], } ], '_POOL_TRACKER_BIG_PAGES' : [ 0x18, { 'Va' : [ 0x0, ['pointer64', ['void']]], @@ -3220,12 +3220,12 @@ ntkrnlmp_types = { 'FaultingVa' : [ 0x8, ['pointer64', ['void']]], } ], '_MMPTE_SUBSECTION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_VI_DEADLOCK_NODE' : [ 0xd0, { 'Parent' : [ 0x0, ['pointer64', ['_VI_DEADLOCK_NODE']]], @@ -3235,10 +3235,10 @@ ntkrnlmp_types = { 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], 'Root' : [ 0x38, ['pointer64', ['_VI_DEADLOCK_RESOURCE']]], 'ThreadEntry' : [ 0x40, ['pointer64', ['_VI_DEADLOCK_THREAD']]], - 'Active' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x48, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x48, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x48, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x48, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'StackTrace' : [ 0x50, ['array', 8, ['pointer64', ['void']]]], 'ParentStackTrace' : [ 0x90, ['array', 8, ['pointer64', ['void']]]], } ], @@ -3315,22 +3315,22 @@ ntkrnlmp_types = { 'LastExceptionFromRip' : [ 0x4c8, ['unsigned long long']], } ], '_MMPTE_HARDWARE_LARGEPAGE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PAT' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 21)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 40)]], - 'reserved2' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PAT' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 21, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 40, native_type='unsigned long long')]], + 'reserved2' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 64, native_type='unsigned long long')]], } ], '_DBGKD_QUERY_SPECIAL_CALLS' : [ 0x4, { 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], @@ -3663,11 +3663,11 @@ ntkrnlmp_types = { '_CM_KEY_CONTROL_BLOCK' : [ 0xa8, { 'RefCount' : [ 0x0, ['unsigned short']], 'Flags' : [ 0x2, ['unsigned short']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x8, ['unsigned long']], 'NextHash' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], @@ -3730,15 +3730,15 @@ ntkrnlmp_types = { 'Period' : [ 0x38, ['long']], } ], '_SEP_AUDIT_POLICY_CATEGORIES' : [ 0x8, { - 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28)]], - 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], - 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28, native_type='unsigned long')]], + 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], + 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], } ], '_CM_KEY_HASH' : [ 0x20, { 'ConvKey' : [ 0x0, ['unsigned long']], @@ -3886,11 +3886,11 @@ ntkrnlmp_types = { '_KIDTENTRY64' : [ 0x10, { 'OffsetLow' : [ 0x0, ['unsigned short']], 'Selector' : [ 0x2, ['unsigned short']], - 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned short')]], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned short')]], + 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned short')]], + 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], 'OffsetMiddle' : [ 0x6, ['unsigned short']], 'OffsetHigh' : [ 0x8, ['unsigned long']], 'Reserved1' : [ 0xc, ['unsigned long']], @@ -3901,11 +3901,11 @@ ntkrnlmp_types = { 'NewCell' : [ 0x4, ['unsigned long']], } ], '_PCI_PMC' : [ 0x2, { - 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], 'Support' : [ 0x1, ['_PM_SUPPORT']], } ], '_DBGKD_CONTINUE' : [ 0x4, { @@ -3931,7 +3931,7 @@ ntkrnlmp_types = { 'ThreadListHead' : [ 0x30, ['_LIST_ENTRY']], } ], '__unnamed_1722' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x28, { @@ -4021,8 +4021,8 @@ ntkrnlmp_types = { } ], '_VI_DEADLOCK_RESOURCE' : [ 0xf8, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockQueuedSpinLock', 7: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer64', ['void']]], 'ThreadOwner' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x18, ['_LIST_ENTRY']], @@ -4069,11 +4069,11 @@ ntkrnlmp_types = { 'PrimaryBus' : [ 0x0, ['unsigned char']], 'SecondaryBus' : [ 0x1, ['unsigned char']], 'SubordinateBus' : [ 0x2, ['unsigned char']], - 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], } ], 'PCI_HEADER_TYPE_DEPENDENT' : [ 0x4, { 'type0' : [ 0x0, ['__unnamed_174c']], @@ -4171,14 +4171,14 @@ ntkrnlmp_types = { 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], } ], '_MMWSLENTRY' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_178e' : [ 0x4, { 'BaseMiddle' : [ 0x0, ['unsigned char']], @@ -4187,16 +4187,16 @@ ntkrnlmp_types = { 'BaseHigh' : [ 0x3, ['unsigned char']], } ], '__unnamed_1792' : [ 0x4, { - 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_KGDTENTRY64' : [ 0x10, { 'LimitLow' : [ 0x0, ['unsigned short']], @@ -4543,10 +4543,10 @@ ntkrnlmp_types = { 'Run' : [ 0x10, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], } ], '_SEGMENT_FLAGS' : [ 0x8, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], } ], '_PI_BUS_EXTENSION' : [ 0x70, { 'Flags' : [ 0x0, ['unsigned long']], @@ -4678,10 +4678,10 @@ ntkrnlmp_types = { 'Data' : [ 0x40, ['_PLUGPLAY_EVENT_BLOCK']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], } ], '_PNP_DEVICE_EVENT_LIST' : [ 0x88, { 'Status' : [ 0x0, ['long']], @@ -4690,16 +4690,16 @@ ntkrnlmp_types = { 'List' : [ 0x78, ['_LIST_ENTRY']], } ], '_MMPTE_TRANSITION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 64, native_type='unsigned long long')]], } ], '_KREQUEST_PACKET' : [ 0x20, { 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer64', ['void']]]], @@ -4711,8 +4711,8 @@ ntkrnlmp_types = { 'Buffer' : [ 0x8, ['pointer64', ['unsigned char']]], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_CM_KEY_SECURITY_CACHE' : [ 0x30, { 'Cell' : [ 0x0, ['unsigned long']], @@ -4728,9 +4728,9 @@ ntkrnlmp_types = { 'DemotePercent' : [ 0xc, ['unsigned char']], 'PromotePercent' : [ 0xd, ['unsigned char']], 'Spare' : [ 0xe, ['array', 2, ['unsigned char']]], - 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_GUID' : [ 0x10, { 'Data1' : [ 0x0, ['unsigned long']], @@ -5351,9 +5351,9 @@ ntkrnlmp_types = { 'Parameter4' : [ 0x20, ['unsigned long long']], } ], '__unnamed_199a' : [ 0x4, { - 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_199c' : [ 0x4, { 'bits' : [ 0x0, ['__unnamed_199a']], @@ -5367,9 +5367,9 @@ ntkrnlmp_types = { 'PostList' : [ 0x10, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x20, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x28, ['pointer64', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x38, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_SID' : [ 0xc, { @@ -5446,14 +5446,14 @@ ntkrnlmp_types = { 'FsFilterCallbacks' : [ 0x30, ['pointer64', ['_FS_FILTER_CALLBACKS']]], } ], '_PM_SUPPORT' : [ 0x1, { - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '__unnamed_19cb' : [ 0x18, { 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], @@ -5563,25 +5563,25 @@ ntkrnlmp_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], diff --git a/volatility/plugins/overlays/windows/win2003_sp1_x86_vtypes.py b/volatility/plugins/overlays/windows/win2003_sp1_x86_vtypes.py index 15030016..0bf24dc5 100644 --- a/volatility/plugins/overlays/windows/win2003_sp1_x86_vtypes.py +++ b/volatility/plugins/overlays/windows/win2003_sp1_x86_vtypes.py @@ -1,4 +1,4 @@ -nt_types = { +ntkrnlmp_types = { 'LIST_ENTRY64' : [ 0x10, { 'Flink' : [ 0x0, ['unsigned long long']], 'Blink' : [ 0x8, ['unsigned long long']], @@ -280,9 +280,9 @@ nt_types = { 'Teb' : [ 0x74, ['pointer', ['void']]], 'Timer' : [ 0x78, ['_KTIMER']], 'TimerFill' : [ 0x78, ['array', 40, ['unsigned char']]], - 'AutoAlignment' : [ 0xa0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xa0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReservedFlags' : [ 0xa0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'AutoAlignment' : [ 0xa0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0xa0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'ReservedFlags' : [ 0xa0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='long')]], 'ThreadFlags' : [ 0xa0, ['long']], 'WaitBlock' : [ 0xa8, ['array', 4, ['_KWAIT_BLOCK']]], 'WaitBlockFill0' : [ 0xa8, ['array', 23, ['unsigned char']]], @@ -386,15 +386,15 @@ nt_types = { } ], '_EX_FAST_REF' : [ 0x4, { 'Object' : [ 0x0, ['pointer', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], } ], '_EX_PUSH_LOCK' : [ 0x4, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -407,8 +407,8 @@ nt_types = { 'ShareCount' : [ 0x1c, ['long']], 'Flags' : [ 0x20, ['long']], } ], - '_EX_PUSH_LOCK_CACHE_AWARE' : [ 0x4, { - 'Locks' : [ 0x0, ['array', 1, ['pointer', ['_EX_PUSH_LOCK']]]], + '_EX_PUSH_LOCK_CACHE_AWARE' : [ 0x80, { + 'Locks' : [ 0x0, ['array', 32, ['pointer', ['_EX_PUSH_LOCK']]]], } ], '_ETHREAD' : [ 0x250, { 'Tcb' : [ 0x0, ['_KTHREAD']], @@ -444,31 +444,31 @@ nt_types = { 'ReadClusterSize' : [ 0x238, ['unsigned long']], 'GrantedAccess' : [ 0x23c, ['unsigned long']], 'CrossThreadFlags' : [ 0x240, ['unsigned long']], - 'Terminated' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeadThread' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x240, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x240, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x240, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x240, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x240, ['BitField', dict(start_bit = 8, end_bit = 9)]], + 'Terminated' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeadThread' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x240, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x240, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x240, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x240, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x240, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x244, ['unsigned long']], - 'ActiveExWorker' : [ 0x244, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x244, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x244, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'KeyedEventInUse' : [ 0x244, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'ActiveExWorker' : [ 0x244, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x244, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x244, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x244, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x248, ['unsigned long']], - 'LpcReceivedMsgIdValid' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LpcExitThreadCalled' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'AddressSpaceOwner' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemWorkingSetExclusive' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemWorkingSetShared' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x249, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ApcNeeded' : [ 0x249, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'LpcReceivedMsgIdValid' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'LpcExitThreadCalled' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'AddressSpaceOwner' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemWorkingSetExclusive' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemWorkingSetShared' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x249, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ApcNeeded' : [ 0x249, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], 'ForwardClusterOnly' : [ 0x24c, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x24d, ['unsigned char']], 'ActiveFaultCount' : [ 0x24e, ['unsigned char']], @@ -543,35 +543,35 @@ nt_types = { 'ModifiedPageCount' : [ 0x238, ['unsigned long']], 'JobStatus' : [ 0x23c, ['unsigned long']], 'Flags' : [ 0x240, ['unsigned long']], - 'CreateReported' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x240, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x240, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x240, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x240, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x240, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x240, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x240, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x240, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x240, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'SessionCreationUnderway' : [ 0x240, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x240, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x240, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x240, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x240, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x240, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x240, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x240, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x240, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x240, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x240, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'SmapAllowed' : [ 0x240, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'CreateFailed' : [ 0x240, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x240, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'Spare1' : [ 0x240, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'Spare2' : [ 0x240, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x240, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x240, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x240, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x240, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x240, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x240, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x240, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x240, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x240, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'SessionCreationUnderway' : [ 0x240, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x240, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x240, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x240, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x240, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x240, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x240, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x240, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x240, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x240, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x240, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SmapAllowed' : [ 0x240, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'CreateFailed' : [ 0x240, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x240, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'Spare1' : [ 0x240, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Spare2' : [ 0x240, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x244, ['long']], 'NextPageColor' : [ 0x248, ['unsigned short']], 'SubSystemMinorVersion' : [ 0x24a, ['unsigned char']], @@ -654,7 +654,7 @@ nt_types = { 'SpecialApcDisable' : [ 0x1e, ['short']], 'CombinedApcDisable' : [ 0x1c, ['unsigned long']], } ], - '__unnamed_1152' : [ 0x4, { + '__unnamed_1154' : [ 0x4, { 'Long' : [ 0x0, ['unsigned long']], 'Flush' : [ 0x0, ['_HARDWARE_PTE']], 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], @@ -665,75 +665,75 @@ nt_types = { 'List' : [ 0x0, ['_MMPTE_LIST']], } ], '_MMPTE' : [ 0x4, { - 'u' : [ 0x0, ['__unnamed_1152']], + 'u' : [ 0x0, ['__unnamed_1154']], } ], - '__unnamed_115f' : [ 0x4, { + '__unnamed_1161' : [ 0x4, { 'Flink' : [ 0x0, ['unsigned long']], 'WsIndex' : [ 0x0, ['unsigned long']], 'Event' : [ 0x0, ['pointer', ['_KEVENT']]], 'ReadStatus' : [ 0x0, ['long']], 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], } ], - '__unnamed_1161' : [ 0x4, { + '__unnamed_1163' : [ 0x4, { 'Blink' : [ 0x0, ['unsigned long']], 'ShareCount' : [ 0x0, ['unsigned long']], } ], - '__unnamed_1164' : [ 0x4, { + '__unnamed_1166' : [ 0x4, { 'ReferenceCount' : [ 0x0, ['unsigned short']], 'ShortFlags' : [ 0x2, ['unsigned short']], } ], - '__unnamed_1166' : [ 0x4, { + '__unnamed_1168' : [ 0x4, { 'ReferenceCount' : [ 0x0, ['unsigned short']], 'e1' : [ 0x2, ['_MMPFNENTRY']], - 'e2' : [ 0x0, ['__unnamed_1164']], + 'e2' : [ 0x0, ['__unnamed_1166']], } ], - '__unnamed_116b' : [ 0x4, { + '__unnamed_116d' : [ 0x4, { 'EntireFrame' : [ 0x0, ['unsigned long']], - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25)]], - 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'Priority' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 31)]], - 'MustBeCached' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 31, native_type='unsigned long')]], + 'MustBeCached' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_MMPFN' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_115f']], + 'u1' : [ 0x0, ['__unnamed_1161']], 'PteAddress' : [ 0x4, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x8, ['__unnamed_1161']], - 'u3' : [ 0xc, ['__unnamed_1166']], + 'u2' : [ 0x8, ['__unnamed_1163']], + 'u3' : [ 0xc, ['__unnamed_1168']], 'OriginalPte' : [ 0x10, ['_MMPTE']], 'AweReferenceCount' : [ 0x10, ['long']], - 'u4' : [ 0x14, ['__unnamed_116b']], + 'u4' : [ 0x14, ['__unnamed_116d']], } ], - '__unnamed_1172' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + '__unnamed_1174' : [ 0x4, { + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMVAD']]], } ], - '__unnamed_1175' : [ 0x4, { + '__unnamed_1177' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], } ], - '__unnamed_117a' : [ 0x4, { + '__unnamed_117c' : [ 0x4, { 'LongFlags2' : [ 0x0, ['unsigned long']], 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], } ], '_MMVAD' : [ 0x28, { - 'u1' : [ 0x0, ['__unnamed_1172']], + 'u1' : [ 0x0, ['__unnamed_1174']], 'LeftChild' : [ 0x4, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x8, ['pointer', ['_MMVAD']]], 'StartingVpn' : [ 0xc, ['unsigned long']], 'EndingVpn' : [ 0x10, ['unsigned long']], - 'u' : [ 0x14, ['__unnamed_1175']], + 'u' : [ 0x14, ['__unnamed_1177']], 'ControlArea' : [ 0x18, ['pointer', ['_CONTROL_AREA']]], 'FirstPrototypePte' : [ 0x1c, ['pointer', ['_MMPTE']]], 'LastContiguousPte' : [ 0x20, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x24, ['__unnamed_117a']], + 'u2' : [ 0x24, ['__unnamed_117c']], } ], '_MM_AVL_TABLE' : [ 0x20, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'NodeHint' : [ 0x18, ['pointer', ['void']]], 'NodeFreeHint' : [ 0x1c, ['pointer', ['void']]], } ], @@ -741,13 +741,13 @@ nt_types = { 'Count' : [ 0x0, ['unsigned long']], 'FlushVa' : [ 0x4, ['array', 33, ['pointer', ['void']]]], } ], - '__unnamed_118c' : [ 0x4, { + '__unnamed_118e' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], } ], '_SUBSECTION' : [ 0x20, { 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], - 'u' : [ 0x4, ['__unnamed_118c']], + 'u' : [ 0x4, ['__unnamed_118e']], 'StartingSector' : [ 0x8, ['unsigned long']], 'NumberOfFullSectors' : [ 0xc, ['unsigned long']], 'SubsectionBase' : [ 0x10, ['pointer', ['_MMPTE']]], @@ -767,10 +767,10 @@ nt_types = { 'Entry' : [ 0x20, ['array', 2, ['pointer', ['_MMMOD_WRITER_MDL_ENTRY']]]], 'PageFileName' : [ 0x28, ['_UNICODE_STRING']], 'Bitmap' : [ 0x30, ['pointer', ['_RTL_BITMAP']]], - 'PageFileNumber' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'ReferenceCount' : [ 0x34, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'BootPartition' : [ 0x34, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Reserved' : [ 0x34, ['BitField', dict(start_bit = 9, end_bit = 32)]], + 'PageFileNumber' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'ReferenceCount' : [ 0x34, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'BootPartition' : [ 0x34, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Reserved' : [ 0x34, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], 'FileHandle' : [ 0x38, ['pointer', ['void']]], } ], '_EXCEPTION_RECORD64' : [ 0x98, { @@ -900,7 +900,7 @@ nt_types = { 'MaxInstructions' : [ 0x14, ['unsigned long']], 'TotalInstructions' : [ 0x18, ['unsigned long']], } ], - '__unnamed_1208' : [ 0x28, { + '__unnamed_120a' : [ 0x28, { 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], @@ -929,9 +929,9 @@ nt_types = { 'ProcessorLevel' : [ 0x4, ['unsigned short']], 'Processor' : [ 0x6, ['unsigned short']], 'ReturnStatus' : [ 0x8, ['long']], - 'u' : [ 0x10, ['__unnamed_1208']], + 'u' : [ 0x10, ['__unnamed_120a']], } ], - '__unnamed_120f' : [ 0x28, { + '__unnamed_1211' : [ 0x28, { 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], @@ -958,7 +958,7 @@ nt_types = { 'ProcessorLevel' : [ 0x4, ['unsigned short']], 'Processor' : [ 0x6, ['unsigned short']], 'ReturnStatus' : [ 0x8, ['long']], - 'u' : [ 0xc, ['__unnamed_120f']], + 'u' : [ 0xc, ['__unnamed_1211']], } ], '_KLOCK_QUEUE_HANDLE' : [ 0xc, { 'LockQueue' : [ 0x0, ['_KSPIN_LOCK_QUEUE']], @@ -1036,25 +1036,25 @@ nt_types = { 'Event' : [ 0x5c, ['_KEVENT']], 'CompletionContext' : [ 0x6c, ['pointer', ['_IO_COMPLETION_CONTEXT']]], } ], - '__unnamed_1238' : [ 0x8, { + '__unnamed_123a' : [ 0x8, { 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], 'ActiveCount' : [ 0x0, ['unsigned short']], } ], '_VACB' : [ 0x18, { 'BaseAddress' : [ 0x0, ['pointer', ['void']]], 'SharedCacheMap' : [ 0x4, ['pointer', ['_SHARED_CACHE_MAP']]], - 'Overlay' : [ 0x8, ['__unnamed_1238']], + 'Overlay' : [ 0x8, ['__unnamed_123a']], 'LruList' : [ 0x10, ['_LIST_ENTRY']], } ], '_VACB_LEVEL_REFERENCE' : [ 0x8, { 'Reference' : [ 0x0, ['long']], 'SpecialReference' : [ 0x4, ['long']], } ], - '__unnamed_124d' : [ 0x10, { + '__unnamed_124f' : [ 0x10, { 'FreeListsInUseUlong' : [ 0x0, ['array', 4, ['unsigned long']]], 'FreeListsInUseBytes' : [ 0x0, ['array', 16, ['unsigned char']]], } ], - '__unnamed_124f' : [ 0x2, { + '__unnamed_1251' : [ 0x2, { 'FreeListsInUseTerminate' : [ 0x0, ['unsigned short']], 'DecommitCount' : [ 0x0, ['unsigned short']], } ], @@ -1082,8 +1082,8 @@ nt_types = { 'AlignMask' : [ 0x4c, ['unsigned long']], 'VirtualAllocdBlocks' : [ 0x50, ['_LIST_ENTRY']], 'Segments' : [ 0x58, ['array', 64, ['pointer', ['_HEAP_SEGMENT']]]], - 'u' : [ 0x158, ['__unnamed_124d']], - 'u2' : [ 0x168, ['__unnamed_124f']], + 'u' : [ 0x158, ['__unnamed_124f']], + 'u2' : [ 0x168, ['__unnamed_1251']], 'AllocatorBackTraceIndex' : [ 0x16a, ['unsigned short']], 'NonDedicatedListLength' : [ 0x16c, ['unsigned long']], 'LargeBlocksIndex' : [ 0x170, ['pointer', ['void']]], @@ -1331,7 +1331,7 @@ nt_types = { 'MmSectionFlags' : [ 0x24, ['pointer', ['_MMSECTION_FLAGS']]], 'MmSubSectionFlags' : [ 0x28, ['pointer', ['_MMSUBSECTION_FLAGS']]], } ], - '__unnamed_1332' : [ 0x4, { + '__unnamed_1337' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], } ], @@ -1343,7 +1343,7 @@ nt_types = { 'NumberOfMappedViews' : [ 0x14, ['unsigned long']], 'NumberOfSystemCacheViews' : [ 0x18, ['unsigned long']], 'NumberOfUserReferences' : [ 0x1c, ['unsigned long']], - 'u' : [ 0x20, ['__unnamed_1332']], + 'u' : [ 0x20, ['__unnamed_1337']], 'FilePointer' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], 'WaitingForDeletion' : [ 0x28, ['pointer', ['_EVENT_COUNTER']]], 'ModifiedWriteCount' : [ 0x2c, ['unsigned short']], @@ -1365,28 +1365,28 @@ nt_types = { 'NextHandleNeedingPool' : [ 0x38, ['unsigned long']], 'HandleCount' : [ 0x3c, ['long']], 'Flags' : [ 0x40, ['unsigned long']], - 'StrictFIFO' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], } ], '_POOL_HEADER' : [ 0x8, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16)]], - 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'AllocatorBackTraceIndex' : [ 0x4, ['unsigned short']], 'PoolTagHash' : [ 0x6, ['unsigned short']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_KWAIT_BLOCK' : [ 0x18, { 'WaitListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -1398,12 +1398,12 @@ nt_types = { 'SpareByte' : [ 0x17, ['unsigned char']], } ], '_MMPTE_PROTOTYPE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_MMSUPPORT' : [ 0x48, { 'WorkingSetExpansionLinks' : [ 0x0, ['_LIST_ENTRY']], @@ -1431,14 +1431,14 @@ nt_types = { 'Info' : [ 0x38, ['EX_QUEUE_WORKER_INFO']], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20)]], - 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20, native_type='unsigned long')]], + 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], } ], '_HEAP_TAG_ENTRY' : [ 0x40, { 'Allocs' : [ 0x0, ['unsigned long']], @@ -1532,7 +1532,7 @@ nt_types = { 'NumberOfMappedViews' : [ 0x14, ['unsigned long']], 'NumberOfSystemCacheViews' : [ 0x18, ['unsigned long']], 'NumberOfUserReferences' : [ 0x1c, ['unsigned long']], - 'u' : [ 0x20, ['__unnamed_1332']], + 'u' : [ 0x20, ['__unnamed_1337']], 'FilePointer' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], 'WaitingForDeletion' : [ 0x28, ['pointer', ['_EVENT_COUNTER']]], 'ModifiedWriteCount' : [ 0x2c, ['unsigned short']], @@ -1596,19 +1596,19 @@ nt_types = { 'Characteristics' : [ 0x12, ['unsigned short']], } ], '_MMPTE_HARDWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Writable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x8, { 'Port' : [ 0x0, ['pointer', ['void']]], @@ -1630,38 +1630,38 @@ nt_types = { 'ContextFlags' : [ 0x0, ['unsigned long']], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'filler' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'filler' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_DEFERRED_WRITE' : [ 0x28, { 'NodeTypeCode' : [ 0x0, ['short']], @@ -1691,13 +1691,13 @@ nt_types = { 'Allocate' : [ 0x1a, ['unsigned char']], } ], '_MMVAD_FLAGS' : [ 0x4, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_KSPIN_LOCK_QUEUE' : [ 0x8, { 'Next' : [ 0x0, ['pointer', ['_KSPIN_LOCK_QUEUE']]], @@ -1709,14 +1709,14 @@ nt_types = { 'EffectiveOnly' : [ 0x5, ['unsigned char']], 'ImpersonationLevel' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], } ], - '__unnamed_13d6' : [ 0x4, { + '__unnamed_13db' : [ 0x4, { 'LegacyDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], 'PendingDeviceRelations' : [ 0x0, ['pointer', ['_DEVICE_RELATIONS']]], } ], - '__unnamed_13d8' : [ 0x4, { + '__unnamed_13dd' : [ 0x4, { 'NextResourceDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], } ], - '__unnamed_13dc' : [ 0x10, { + '__unnamed_13e1' : [ 0x10, { 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], 'ListEntry' : [ 0x4, ['_LIST_ENTRY']], 'SerialNumber' : [ 0xc, ['pointer', ['unsigned short']]], @@ -1758,11 +1758,11 @@ nt_types = { 'QueryTranslatorMask' : [ 0xda, ['unsigned short']], 'NoArbiterMask' : [ 0xdc, ['unsigned short']], 'QueryArbiterMask' : [ 0xde, ['unsigned short']], - 'OverUsed1' : [ 0xe0, ['__unnamed_13d6']], - 'OverUsed2' : [ 0xe4, ['__unnamed_13d8']], + 'OverUsed1' : [ 0xe0, ['__unnamed_13db']], + 'OverUsed2' : [ 0xe4, ['__unnamed_13dd']], 'BootResources' : [ 0xe8, ['pointer', ['_CM_RESOURCE_LIST']]], 'CapabilityFlags' : [ 0xec, ['unsigned long']], - 'DockInfo' : [ 0xf0, ['__unnamed_13dc']], + 'DockInfo' : [ 0xf0, ['__unnamed_13e1']], 'DisableableDepends' : [ 0x100, ['unsigned long']], 'PendedSetInterfaceState' : [ 0x104, ['_LIST_ENTRY']], 'LegacyBusListEntry' : [ 0x10c, ['_LIST_ENTRY']], @@ -1770,12 +1770,12 @@ nt_types = { 'PreviousParent' : [ 0x118, ['pointer', ['_DEVICE_NODE']]], 'DeletedChildren' : [ 0x11c, ['unsigned long']], } ], - '__unnamed_13e1' : [ 0x38, { + '__unnamed_13e6' : [ 0x38, { 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], 'Resource' : [ 0x0, ['_ERESOURCE']], } ], '_HEAP_LOCK' : [ 0x38, { - 'Lock' : [ 0x0, ['__unnamed_13e1']], + 'Lock' : [ 0x0, ['__unnamed_13e6']], } ], '_MMCOLOR_TABLES' : [ 0xc, { 'Flink' : [ 0x0, ['unsigned long']], @@ -1817,10 +1817,10 @@ nt_types = { 'ThreadListHead' : [ 0x50, ['_LIST_ENTRY']], 'ProcessLock' : [ 0x58, ['unsigned long']], 'Affinity' : [ 0x5c, ['unsigned long']], - 'AutoAlignment' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x60, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0x60, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ReservedFlags' : [ 0x60, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'AutoAlignment' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x60, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x60, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ReservedFlags' : [ 0x60, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='long')]], 'ProcessFlags' : [ 0x60, ['long']], 'BasePriority' : [ 0x64, ['unsigned char']], 'QuantumReset' : [ 0x65, ['unsigned char']], @@ -1838,14 +1838,14 @@ nt_types = { 'BasePage' : [ 0x0, ['unsigned long']], 'PageCount' : [ 0x4, ['unsigned long']], } ], - '__unnamed_13fb' : [ 0x4, { + '__unnamed_1400' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], } ], '_MM_SESSION_SPACE' : [ 0x1ec0, { 'GlobalVirtualAddress' : [ 0x0, ['pointer', ['_MM_SESSION_SPACE']]], 'ReferenceCount' : [ 0x4, ['long']], - 'u' : [ 0x8, ['__unnamed_13fb']], + 'u' : [ 0x8, ['__unnamed_1400']], 'SessionId' : [ 0xc, ['unsigned long']], 'ProcessList' : [ 0x10, ['_LIST_ENTRY']], 'LastProcessSwappedOutTime' : [ 0x18, ['_LARGE_INTEGER']], @@ -1881,8 +1881,8 @@ nt_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['pointer', ['void']]], 'ImageBaseAddress' : [ 0x8, ['pointer', ['void']]], 'Ldr' : [ 0xc, ['pointer', ['_PEB_LDR_DATA']]], @@ -1964,12 +1964,12 @@ nt_types = { 'Unused' : [ 0x0, ['unsigned long']], } ], '_MMPTE_SOFTWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { 'ListSize' : [ 0x0, ['unsigned long']], @@ -1980,14 +1980,14 @@ nt_types = { 'AlternativeLists' : [ 0x1c, ['unsigned long']], 'List' : [ 0x20, ['array', 1, ['_IO_RESOURCE_LIST']]], } ], - '__unnamed_142a' : [ 0x8, { + '__unnamed_142f' : [ 0x8, { 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], 'LastByte' : [ 0x0, ['_LARGE_INTEGER']], } ], '_MMMOD_WRITER_MDL_ENTRY' : [ 0x60, { 'Links' : [ 0x0, ['_LIST_ENTRY']], 'WriteOffset' : [ 0x8, ['_LARGE_INTEGER']], - 'u' : [ 0x10, ['__unnamed_142a']], + 'u' : [ 0x10, ['__unnamed_142f']], 'Irp' : [ 0x18, ['pointer', ['_IRP']]], 'LastPageToWrite' : [ 0x1c, ['unsigned long']], 'PagingListHead' : [ 0x20, ['pointer', ['_MMMOD_WRITER_LISTHEAD']]], @@ -2024,20 +2024,20 @@ nt_types = { 'Peak' : [ 0x8, ['unsigned long']], 'Return' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1440' : [ 0x50, { + '__unnamed_1445' : [ 0x50, { 'CellData' : [ 0x0, ['_CELL_DATA']], 'List' : [ 0x0, ['array', 1, ['unsigned long']]], } ], '_CM_CACHED_VALUE_INDEX' : [ 0x54, { 'CellIndex' : [ 0x0, ['unsigned long']], - 'Data' : [ 0x4, ['__unnamed_1440']], + 'Data' : [ 0x4, ['__unnamed_1445']], } ], - '__unnamed_1446' : [ 0x208, { + '__unnamed_144b' : [ 0x208, { 'FnArea' : [ 0x0, ['_FNSAVE_FORMAT']], 'FxArea' : [ 0x0, ['_FXSAVE_FORMAT']], } ], '_FX_SAVE_AREA' : [ 0x210, { - 'U' : [ 0x0, ['__unnamed_1446']], + 'U' : [ 0x0, ['__unnamed_144b']], 'NpxSavedCpu' : [ 0x208, ['unsigned long']], 'Cr0NpxState' : [ 0x20c, ['unsigned long']], } ], @@ -2097,16 +2097,16 @@ nt_types = { 'DataValueHigh' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11)]], - 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned short')]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11, native_type='unsigned short')]], + 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14, native_type='unsigned short')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned short')]], + 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], } ], '_IO_COUNTERS' : [ 0x30, { 'ReadOperationCount' : [ 0x0, ['unsigned long long']], @@ -2183,18 +2183,18 @@ nt_types = { 'Volume' : [ 0x44, ['_LIST_ENTRY']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Available0' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'MemoryPriority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'GrowWsleHash' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AcquiredUnsafe' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Available' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Available0' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'GrowWsleHash' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'AcquiredUnsafe' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Available' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], '_TERMINATION_PORT' : [ 0x8, { 'Next' : [ 0x0, ['pointer', ['_TERMINATION_PORT']]], @@ -2273,8 +2273,8 @@ nt_types = { 'Revision' : [ 0x0, ['unsigned long']], 'DynamicThrottle' : [ 0x4, ['unsigned char']], 'Spare' : [ 0x5, ['array', 3, ['unsigned char']]], - 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'PolicyCount' : [ 0xc, ['unsigned long']], 'Policy' : [ 0x10, ['array', 3, ['_PROCESSOR_POWER_POLICY_INFO']]], } ], @@ -2333,10 +2333,10 @@ nt_types = { 'RegisterArea' : [ 0x1c, ['array', 80, ['unsigned char']]], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'SYSTEM_POWER_LEVEL' : [ 0x18, { @@ -2395,12 +2395,12 @@ nt_types = { '_tmpfname' : [ 0x1c, ['pointer', ['unsigned char']]], } ], '_MMPTE_LIST' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_CMHIVE' : [ 0x57c, { 'Hive' : [ 0x0, ['_HHIVE']], @@ -2501,9 +2501,9 @@ nt_types = { 'Name' : [ 0xc, ['array', 1, ['unsigned short']]], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x18, { 'Version' : [ 0x0, ['unsigned short']], @@ -2523,7 +2523,7 @@ nt_types = { 'SecurityQos' : [ 0x20, ['pointer', ['_SECURITY_QUALITY_OF_SERVICE']]], 'SecurityQualityOfService' : [ 0x24, ['_SECURITY_QUALITY_OF_SERVICE']], } ], - '__unnamed_1516' : [ 0x28, { + '__unnamed_151b' : [ 0x28, { 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], } ], @@ -2542,7 +2542,7 @@ nt_types = { 'DeviceExtension' : [ 0x28, ['pointer', ['void']]], 'DeviceType' : [ 0x2c, ['unsigned long']], 'StackSize' : [ 0x30, ['unsigned char']], - 'Queue' : [ 0x34, ['__unnamed_1516']], + 'Queue' : [ 0x34, ['__unnamed_151b']], 'AlignmentRequirement' : [ 0x5c, ['unsigned long']], 'DeviceQueue' : [ 0x60, ['_KDEVICE_QUEUE']], 'Dpc' : [ 0x74, ['_KDPC']], @@ -2667,36 +2667,36 @@ nt_types = { 'QueryNameProcedure' : [ 0x44, ['pointer', ['void']]], 'OkayToCloseProcedure' : [ 0x48, ['pointer', ['void']]], } ], - '__unnamed_1560' : [ 0x8, { + '__unnamed_1565' : [ 0x8, { 'List' : [ 0x0, ['_LIST_ENTRY']], 'Secured' : [ 0x0, ['_MMADDRESS_LIST']], } ], - '__unnamed_1566' : [ 0x4, { + '__unnamed_156b' : [ 0x4, { 'Banked' : [ 0x0, ['pointer', ['_MMBANKED_SECTION']]], 'ExtendedInfo' : [ 0x0, ['pointer', ['_MMEXTEND_INFO']]], } ], '_MMVAD_LONG' : [ 0x34, { - 'u1' : [ 0x0, ['__unnamed_1172']], + 'u1' : [ 0x0, ['__unnamed_1174']], 'LeftChild' : [ 0x4, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x8, ['pointer', ['_MMVAD']]], 'StartingVpn' : [ 0xc, ['unsigned long']], 'EndingVpn' : [ 0x10, ['unsigned long']], - 'u' : [ 0x14, ['__unnamed_1175']], + 'u' : [ 0x14, ['__unnamed_1177']], 'ControlArea' : [ 0x18, ['pointer', ['_CONTROL_AREA']]], 'FirstPrototypePte' : [ 0x1c, ['pointer', ['_MMPTE']]], 'LastContiguousPte' : [ 0x20, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x24, ['__unnamed_117a']], - 'u3' : [ 0x28, ['__unnamed_1560']], - 'u4' : [ 0x30, ['__unnamed_1566']], + 'u2' : [ 0x24, ['__unnamed_117c']], + 'u3' : [ 0x28, ['__unnamed_1565']], + 'u4' : [ 0x30, ['__unnamed_156b']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], } ], '_POOL_DESCRIPTOR' : [ 0x1030, { 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], @@ -2714,19 +2714,19 @@ nt_types = { 'ListHeads' : [ 0x30, ['array', 512, ['_LIST_ENTRY']]], } ], '_HARDWARE_PTE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_PEB_LDR_DATA' : [ 0x28, { 'Length' : [ 0x0, ['unsigned long']], @@ -2813,8 +2813,8 @@ nt_types = { 'Handler' : [ 0x4, ['pointer', ['void']]], } ], '_SEP_AUDIT_POLICY_OVERLAY' : [ 0x8, { - 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36)]], - 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37)]], + 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], } ], '_POOL_TRACKER_BIG_PAGES' : [ 0x10, { 'Va' : [ 0x0, ['pointer', ['void']]], @@ -2827,12 +2827,12 @@ nt_types = { 'FaultingVa' : [ 0x4, ['pointer', ['void']]], } ], '_MMPTE_SUBSECTION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 31)]], - 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 31, native_type='unsigned long')]], + 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_VI_DEADLOCK_NODE' : [ 0x68, { 'Parent' : [ 0x0, ['pointer', ['_VI_DEADLOCK_NODE']]], @@ -2842,10 +2842,10 @@ nt_types = { 'FreeListEntry' : [ 0x14, ['_LIST_ENTRY']], 'Root' : [ 0x1c, ['pointer', ['_VI_DEADLOCK_RESOURCE']]], 'ThreadEntry' : [ 0x20, ['pointer', ['_VI_DEADLOCK_THREAD']]], - 'Active' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x24, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x24, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'StackTrace' : [ 0x28, ['array', 8, ['pointer', ['void']]]], 'ParentStackTrace' : [ 0x48, ['array', 8, ['pointer', ['void']]]], } ], @@ -2995,18 +2995,18 @@ nt_types = { 'Sacl' : [ 0xc, ['pointer', ['_ACL']]], 'Dacl' : [ 0x10, ['pointer', ['_ACL']]], } ], - '__unnamed_15d6' : [ 0x8, { + '__unnamed_15da' : [ 0x8, { 'UserData' : [ 0x0, ['pointer', ['void']]], 'Owner' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_15d8' : [ 0x8, { + '__unnamed_15dc' : [ 0x8, { 'ListHead' : [ 0x0, ['_LIST_ENTRY']], } ], '_RTLP_RANGE_LIST_ENTRY' : [ 0x28, { 'Start' : [ 0x0, ['unsigned long long']], 'End' : [ 0x8, ['unsigned long long']], - 'Allocated' : [ 0x10, ['__unnamed_15d6']], - 'Merged' : [ 0x10, ['__unnamed_15d8']], + 'Allocated' : [ 0x10, ['__unnamed_15da']], + 'Merged' : [ 0x10, ['__unnamed_15dc']], 'Attributes' : [ 0x18, ['unsigned char']], 'PublicFlags' : [ 0x19, ['unsigned char']], 'PrivateFlags' : [ 0x1a, ['unsigned short']], @@ -3104,34 +3104,34 @@ nt_types = { 'V86Fs' : [ 0x84, ['unsigned long']], 'V86Gs' : [ 0x88, ['unsigned long']], } ], - '__unnamed_15fc' : [ 0x4, { + '__unnamed_1600' : [ 0x4, { 'BaseMid' : [ 0x0, ['unsigned char']], 'Flags1' : [ 0x1, ['unsigned char']], 'Flags2' : [ 0x2, ['unsigned char']], 'BaseHi' : [ 0x3, ['unsigned char']], } ], - '__unnamed_1603' : [ 0x4, { - 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + '__unnamed_1607' : [ 0x4, { + 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], - '__unnamed_1605' : [ 0x4, { - 'Bytes' : [ 0x0, ['__unnamed_15fc']], - 'Bits' : [ 0x0, ['__unnamed_1603']], + '__unnamed_1609' : [ 0x4, { + 'Bytes' : [ 0x0, ['__unnamed_1600']], + 'Bits' : [ 0x0, ['__unnamed_1607']], } ], '_KGDTENTRY' : [ 0x8, { 'LimitLow' : [ 0x0, ['unsigned short']], 'BaseLow' : [ 0x2, ['unsigned short']], - 'HighWord' : [ 0x4, ['__unnamed_1605']], + 'HighWord' : [ 0x4, ['__unnamed_1609']], } ], - '__unnamed_160f' : [ 0x5, { + '__unnamed_1613' : [ 0x5, { 'Acquired' : [ 0x0, ['unsigned char']], 'CacheLineSize' : [ 0x1, ['unsigned char']], 'LatencyTimer' : [ 0x2, ['unsigned char']], @@ -3168,51 +3168,51 @@ nt_types = { 'ChildWaitWakeCount' : [ 0xa4, ['unsigned long']], 'PreservedConfig' : [ 0xa8, ['pointer', ['_PCI_COMMON_CONFIG']]], 'Lock' : [ 0xac, ['_PCI_LOCK']], - 'HotPlugParameters' : [ 0xb4, ['__unnamed_160f']], + 'HotPlugParameters' : [ 0xb4, ['__unnamed_1613']], 'BusHackFlags' : [ 0xbc, ['unsigned long']], } ], - '__unnamed_1613' : [ 0xc, { + '__unnamed_1617' : [ 0xc, { 'Start' : [ 0x0, ['_LARGE_INTEGER']], 'Length' : [ 0x8, ['unsigned long']], } ], - '__unnamed_1615' : [ 0xc, { + '__unnamed_1619' : [ 0xc, { 'Level' : [ 0x0, ['unsigned long']], 'Vector' : [ 0x4, ['unsigned long']], 'Affinity' : [ 0x8, ['unsigned long']], } ], - '__unnamed_1617' : [ 0xc, { + '__unnamed_161b' : [ 0xc, { 'Channel' : [ 0x0, ['unsigned long']], 'Port' : [ 0x4, ['unsigned long']], 'Reserved1' : [ 0x8, ['unsigned long']], } ], - '__unnamed_1619' : [ 0xc, { + '__unnamed_161d' : [ 0xc, { 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], } ], - '__unnamed_161b' : [ 0xc, { + '__unnamed_161f' : [ 0xc, { 'Start' : [ 0x0, ['unsigned long']], 'Length' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned long']], } ], - '__unnamed_161d' : [ 0xc, { + '__unnamed_1621' : [ 0xc, { 'DataSize' : [ 0x0, ['unsigned long']], 'Reserved1' : [ 0x4, ['unsigned long']], 'Reserved2' : [ 0x8, ['unsigned long']], } ], - '__unnamed_161f' : [ 0xc, { - 'Generic' : [ 0x0, ['__unnamed_1613']], - 'Port' : [ 0x0, ['__unnamed_1613']], - 'Interrupt' : [ 0x0, ['__unnamed_1615']], - 'Memory' : [ 0x0, ['__unnamed_1613']], - 'Dma' : [ 0x0, ['__unnamed_1617']], - 'DevicePrivate' : [ 0x0, ['__unnamed_1619']], - 'BusNumber' : [ 0x0, ['__unnamed_161b']], - 'DeviceSpecificData' : [ 0x0, ['__unnamed_161d']], + '__unnamed_1623' : [ 0xc, { + 'Generic' : [ 0x0, ['__unnamed_1617']], + 'Port' : [ 0x0, ['__unnamed_1617']], + 'Interrupt' : [ 0x0, ['__unnamed_1619']], + 'Memory' : [ 0x0, ['__unnamed_1617']], + 'Dma' : [ 0x0, ['__unnamed_161b']], + 'DevicePrivate' : [ 0x0, ['__unnamed_161d']], + 'BusNumber' : [ 0x0, ['__unnamed_161f']], + 'DeviceSpecificData' : [ 0x0, ['__unnamed_1621']], } ], '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x10, { 'Type' : [ 0x0, ['unsigned char']], 'ShareDisposition' : [ 0x1, ['unsigned char']], 'Flags' : [ 0x2, ['unsigned short']], - 'u' : [ 0x4, ['__unnamed_161f']], + 'u' : [ 0x4, ['__unnamed_1623']], } ], '_WAIT_CONTEXT_BLOCK' : [ 0x28, { 'WaitQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], @@ -3226,11 +3226,11 @@ nt_types = { '_CM_KEY_CONTROL_BLOCK' : [ 0x60, { 'RefCount' : [ 0x0, ['unsigned short']], 'Flags' : [ 0x2, ['unsigned short']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x8, ['unsigned long']], 'NextHash' : [ 0xc, ['pointer', ['_CM_KEY_HASH']]], @@ -3288,15 +3288,15 @@ nt_types = { 'Period' : [ 0x24, ['long']], } ], '_SEP_AUDIT_POLICY_CATEGORIES' : [ 0x8, { - 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28)]], - 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], - 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28, native_type='unsigned long')]], + 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], + 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], } ], '_CM_KEY_HASH' : [ 0x10, { 'ConvKey' : [ 0x0, ['unsigned long']], @@ -3304,20 +3304,20 @@ nt_types = { 'KeyHive' : [ 0x8, ['pointer', ['_HHIVE']]], 'KeyCell' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1659' : [ 0x4, { + '__unnamed_165d' : [ 0x4, { 'MasterIrp' : [ 0x0, ['pointer', ['_IRP']]], 'IrpCount' : [ 0x0, ['long']], 'SystemBuffer' : [ 0x0, ['pointer', ['void']]], } ], - '__unnamed_165f' : [ 0x8, { + '__unnamed_1663' : [ 0x8, { 'UserApcRoutine' : [ 0x0, ['pointer', ['void']]], 'UserApcContext' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_1661' : [ 0x8, { - 'AsynchronousParameters' : [ 0x0, ['__unnamed_165f']], + '__unnamed_1665' : [ 0x8, { + 'AsynchronousParameters' : [ 0x0, ['__unnamed_1663']], 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], } ], - '__unnamed_1669' : [ 0x28, { + '__unnamed_166d' : [ 0x28, { 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], 'DriverContext' : [ 0x0, ['array', 4, ['pointer', ['void']]]], 'Thread' : [ 0x10, ['pointer', ['_ETHREAD']]], @@ -3327,8 +3327,8 @@ nt_types = { 'PacketType' : [ 0x20, ['unsigned long']], 'OriginalFileObject' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], } ], - '__unnamed_166b' : [ 0x30, { - 'Overlay' : [ 0x0, ['__unnamed_1669']], + '__unnamed_166f' : [ 0x30, { + 'Overlay' : [ 0x0, ['__unnamed_166d']], 'Apc' : [ 0x0, ['_KAPC']], 'CompletionKey' : [ 0x0, ['pointer', ['void']]], } ], @@ -3337,7 +3337,7 @@ nt_types = { 'Size' : [ 0x2, ['unsigned short']], 'MdlAddress' : [ 0x4, ['pointer', ['_MDL']]], 'Flags' : [ 0x8, ['unsigned long']], - 'AssociatedIrp' : [ 0xc, ['__unnamed_1659']], + 'AssociatedIrp' : [ 0xc, ['__unnamed_165d']], 'ThreadListEntry' : [ 0x10, ['_LIST_ENTRY']], 'IoStatus' : [ 0x18, ['_IO_STATUS_BLOCK']], 'RequestorMode' : [ 0x20, ['unsigned char']], @@ -3350,10 +3350,10 @@ nt_types = { 'AllocationFlags' : [ 0x27, ['unsigned char']], 'UserIosb' : [ 0x28, ['pointer', ['_IO_STATUS_BLOCK']]], 'UserEvent' : [ 0x2c, ['pointer', ['_KEVENT']]], - 'Overlay' : [ 0x30, ['__unnamed_1661']], + 'Overlay' : [ 0x30, ['__unnamed_1665']], 'CancelRoutine' : [ 0x38, ['pointer', ['void']]], 'UserBuffer' : [ 0x3c, ['pointer', ['void']]], - 'Tail' : [ 0x40, ['__unnamed_166b']], + 'Tail' : [ 0x40, ['__unnamed_166f']], } ], '_PCI_LOCK' : [ 0x8, { 'Atom' : [ 0x0, ['unsigned long']], @@ -3363,13 +3363,13 @@ nt_types = { 'Cell' : [ 0x0, ['unsigned long']], 'CachedSecurity' : [ 0x4, ['pointer', ['_CM_KEY_SECURITY_CACHE']]], } ], - '__unnamed_1677' : [ 0x4, { + '__unnamed_167b' : [ 0x4, { 'PhysicalAddress' : [ 0x0, ['unsigned long']], 'VirtualSize' : [ 0x0, ['unsigned long']], } ], '_IMAGE_SECTION_HEADER' : [ 0x28, { 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], - 'Misc' : [ 0x8, ['__unnamed_1677']], + 'Misc' : [ 0x8, ['__unnamed_167b']], 'VirtualAddress' : [ 0xc, ['unsigned long']], 'SizeOfRawData' : [ 0x10, ['unsigned long']], 'PointerToRawData' : [ 0x14, ['unsigned long']], @@ -3379,14 +3379,14 @@ nt_types = { 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], 'Characteristics' : [ 0x24, ['unsigned long']], } ], - '__unnamed_167d' : [ 0x4, { + '__unnamed_1681' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], } ], '_POP_ACTION_TRIGGER' : [ 0xc, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyInitiatePowerActionAPI', 4: 'PolicySetPowerStateAPI', 5: 'PolicyImmediateDozeS4', 6: 'PolicySystemIdle'})]], 'Flags' : [ 0x4, ['unsigned char']], 'Spare' : [ 0x5, ['array', 3, ['unsigned char']]], - 'Battery' : [ 0x8, ['__unnamed_167d']], + 'Battery' : [ 0x8, ['__unnamed_1681']], 'Wait' : [ 0x8, ['pointer', ['_POP_TRIGGER_WAIT']]], } ], '_ETIMER' : [ 0x98, { @@ -3409,23 +3409,23 @@ nt_types = { 'NewCell' : [ 0x4, ['unsigned long']], } ], '_PCI_PMC' : [ 0x2, { - 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], 'Support' : [ 0x1, ['_PM_SUPPORT']], } ], '_DBGKD_CONTINUE' : [ 0x4, { 'ContinueStatus' : [ 0x0, ['long']], } ], - '__unnamed_1693' : [ 0x4, { + '__unnamed_1697' : [ 0x4, { 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], 'Long' : [ 0x0, ['unsigned long']], 'e1' : [ 0x0, ['_MMWSLENTRY']], } ], '_MMWSLE' : [ 0x4, { - 'u1' : [ 0x0, ['__unnamed_1693']], + 'u1' : [ 0x0, ['__unnamed_1697']], } ], '_EXCEPTION_POINTERS' : [ 0x8, { 'ExceptionRecord' : [ 0x0, ['pointer', ['_EXCEPTION_RECORD']]], @@ -3438,12 +3438,12 @@ nt_types = { 'MaximumCount' : [ 0x1c, ['unsigned long']], 'ThreadListHead' : [ 0x20, ['_LIST_ENTRY']], } ], - '__unnamed_169d' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + '__unnamed_16a1' : [ 0x4, { + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x14, { - 'u1' : [ 0x0, ['__unnamed_169d']], + 'u1' : [ 0x0, ['__unnamed_16a1']], 'LeftChild' : [ 0x4, ['pointer', ['_MMADDRESS_NODE']]], 'RightChild' : [ 0x8, ['pointer', ['_MMADDRESS_NODE']]], 'StartingVpn' : [ 0xc, ['unsigned long']], @@ -3499,8 +3499,8 @@ nt_types = { } ], '_VI_DEADLOCK_RESOURCE' : [ 0x80, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockQueuedSpinLock', 7: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer', ['void']]], 'ThreadOwner' : [ 0xc, ['pointer', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x10, ['_LIST_ENTRY']], @@ -3540,23 +3540,23 @@ nt_types = { 'Flink' : [ 0x8, ['unsigned long']], 'Blink' : [ 0xc, ['unsigned long']], } ], - '__unnamed_16c2' : [ 0x4, { + '__unnamed_16c7' : [ 0x4, { 'Spare' : [ 0x0, ['array', 4, ['unsigned char']]], } ], - '__unnamed_16c4' : [ 0x4, { + '__unnamed_16c9' : [ 0x4, { 'PrimaryBus' : [ 0x0, ['unsigned char']], 'SecondaryBus' : [ 0x1, ['unsigned char']], 'SubordinateBus' : [ 0x2, ['unsigned char']], - 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], } ], 'PCI_HEADER_TYPE_DEPENDENT' : [ 0x4, { - 'type0' : [ 0x0, ['__unnamed_16c2']], - 'type1' : [ 0x0, ['__unnamed_16c4']], - 'type2' : [ 0x0, ['__unnamed_16c4']], + 'type0' : [ 0x0, ['__unnamed_16c7']], + 'type1' : [ 0x0, ['__unnamed_16c9']], + 'type2' : [ 0x0, ['__unnamed_16c9']], } ], '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { 'BusDataType' : [ 0x0, ['unsigned long']], @@ -3653,14 +3653,14 @@ nt_types = { 'Align16Byte' : [ 0x200, ['array', 8, ['unsigned char']]], } ], '_MMWSLENTRY' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_OBJECT_DIRECTORY' : [ 0xa0, { 'HashBuckets' : [ 0x0, ['array', 37, ['pointer', ['_OBJECT_DIRECTORY_ENTRY']]]], @@ -3742,11 +3742,11 @@ nt_types = { 'Abandoned' : [ 0x1c, ['unsigned char']], 'ApcDisable' : [ 0x1d, ['unsigned char']], } ], - '__unnamed_172e' : [ 0x4, { + '__unnamed_1733' : [ 0x4, { 'ImageCommitment' : [ 0x0, ['unsigned long']], 'CreatingProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], } ], - '__unnamed_1732' : [ 0x4, { + '__unnamed_1737' : [ 0x4, { 'ImageInformation' : [ 0x0, ['pointer', ['_SECTION_IMAGE_INFORMATION']]], 'FirstMappedVa' : [ 0x0, ['pointer', ['void']]], } ], @@ -3761,8 +3761,8 @@ nt_types = { 'ExtendInfo' : [ 0x20, ['pointer', ['_MMEXTEND_INFO']]], 'SegmentFlags' : [ 0x24, ['_SEGMENT_FLAGS']], 'BasedAddress' : [ 0x28, ['pointer', ['void']]], - 'u1' : [ 0x2c, ['__unnamed_172e']], - 'u2' : [ 0x30, ['__unnamed_1732']], + 'u1' : [ 0x2c, ['__unnamed_1733']], + 'u2' : [ 0x30, ['__unnamed_1737']], 'PrototypePte' : [ 0x34, ['pointer', ['_MMPTE']]], 'ThePtes' : [ 0x38, ['array', 1, ['_MMPTE']]], } ], @@ -3990,7 +3990,7 @@ nt_types = { 'ExtensionType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1768116272: 'PciPdoExtensionType', 1768116273: 'PciFdoExtensionType', 1768116274: 'PciArb_Io', 1768116275: 'PciArb_Memory', 1768116276: 'PciArb_Interrupt', 1768116277: 'PciArb_BusNumber', 1768116278: 'PciTrans_Interrupt', 1768116279: 'PciInterface_BusHandler', 1768116280: 'PciInterface_IntRouteHandler', 1768116281: 'PciInterface_PciCb', 1768116282: 'PciInterface_LegacyDeviceDetection', 1768116283: 'PciInterface_PmeHandler', 1768116284: 'PciInterface_DevicePresent', 1768116285: 'PciInterface_NativeIde', 1768116286: 'PciInterface_Location', 1768116287: 'PciInterface_AgpTarget'})]], 'Destructor' : [ 0x8, ['pointer', ['void']]], } ], - '__unnamed_1771' : [ 0x30, { + '__unnamed_1776' : [ 0x30, { 'type0' : [ 0x0, ['_PCI_HEADER_TYPE_0']], 'type1' : [ 0x0, ['_PCI_HEADER_TYPE_1']], 'type2' : [ 0x0, ['_PCI_HEADER_TYPE_2']], @@ -4008,7 +4008,7 @@ nt_types = { 'LatencyTimer' : [ 0xd, ['unsigned char']], 'HeaderType' : [ 0xe, ['unsigned char']], 'BIST' : [ 0xf, ['unsigned char']], - 'u' : [ 0x10, ['__unnamed_1771']], + 'u' : [ 0x10, ['__unnamed_1776']], 'DeviceSpecific' : [ 0x40, ['array', 192, ['unsigned char']]], } ], '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { @@ -4067,10 +4067,10 @@ nt_types = { 'Run' : [ 0x8, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], } ], '_SEGMENT_FLAGS' : [ 0x4, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_PI_BUS_EXTENSION' : [ 0x44, { 'Flags' : [ 0x0, ['unsigned long']], @@ -4153,14 +4153,14 @@ nt_types = { 'Request' : [ 0x18, ['_PORT_MESSAGE']], } ], '_MMVAD_SHORT' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_1172']], + 'u1' : [ 0x0, ['__unnamed_1174']], 'LeftChild' : [ 0x4, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x8, ['pointer', ['_MMVAD']]], 'StartingVpn' : [ 0xc, ['unsigned long']], 'EndingVpn' : [ 0x10, ['unsigned long']], - 'u' : [ 0x14, ['__unnamed_1175']], + 'u' : [ 0x14, ['__unnamed_1177']], } ], - '__unnamed_17b8' : [ 0x2c, { + '__unnamed_17bd' : [ 0x2c, { 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], } ], @@ -4177,7 +4177,7 @@ nt_types = { 'SubjectSecurityContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], 'SecurityDescriptor' : [ 0x2c, ['pointer', ['void']]], 'AuxData' : [ 0x30, ['pointer', ['void']]], - 'Privileges' : [ 0x34, ['__unnamed_17b8']], + 'Privileges' : [ 0x34, ['__unnamed_17bd']], 'AuditPrivileges' : [ 0x60, ['unsigned char']], 'ObjectName' : [ 0x64, ['_UNICODE_STRING']], 'ObjectTypeName' : [ 0x6c, ['_UNICODE_STRING']], @@ -4193,10 +4193,10 @@ nt_types = { 'Data' : [ 0x20, ['_PLUGPLAY_EVENT_BLOCK']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], } ], '_PNP_DEVICE_EVENT_LIST' : [ 0x4c, { 'Status' : [ 0x0, ['long']], @@ -4209,15 +4209,15 @@ nt_types = { 'SpecialRegisters' : [ 0x2cc, ['_KSPECIAL_REGISTERS']], } ], '_MMPTE_TRANSITION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_STRING' : [ 0x8, { 'Length' : [ 0x0, ['unsigned short']], @@ -4225,8 +4225,8 @@ nt_types = { 'Buffer' : [ 0x4, ['pointer', ['unsigned char']]], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_CM_KEY_SECURITY_CACHE' : [ 0x28, { 'Cell' : [ 0x0, ['unsigned long']], @@ -4242,9 +4242,9 @@ nt_types = { 'DemotePercent' : [ 0xc, ['unsigned char']], 'PromotePercent' : [ 0xd, ['unsigned char']], 'Spare' : [ 0xe, ['array', 2, ['unsigned char']]], - 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_GUID' : [ 0x10, { 'Data1' : [ 0x0, ['unsigned long']], @@ -4442,47 +4442,47 @@ nt_types = { 'Count' : [ 0x0, ['unsigned long']], 'HashKey' : [ 0x4, ['array', 1, ['unsigned long']]], } ], - '__unnamed_185a' : [ 0x10, { + '__unnamed_185f' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'FileAttributes' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'EaLength' : [ 0xc, ['unsigned long']], } ], - '__unnamed_185e' : [ 0x10, { + '__unnamed_1863' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'Parameters' : [ 0xc, ['pointer', ['_NAMED_PIPE_CREATE_PARAMETERS']]], } ], - '__unnamed_1862' : [ 0x10, { + '__unnamed_1867' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'Parameters' : [ 0xc, ['pointer', ['_MAILSLOT_CREATE_PARAMETERS']]], } ], - '__unnamed_1864' : [ 0x10, { + '__unnamed_1869' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'Key' : [ 0x4, ['unsigned long']], 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], } ], - '__unnamed_1868' : [ 0x10, { + '__unnamed_186d' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'FileName' : [ 0x4, ['pointer', ['_UNICODE_STRING']]], 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileMaximumInformation'})]], 'FileIndex' : [ 0xc, ['unsigned long']], } ], - '__unnamed_186a' : [ 0x8, { + '__unnamed_186f' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'CompletionFilter' : [ 0x4, ['unsigned long']], } ], - '__unnamed_186c' : [ 0x8, { + '__unnamed_1871' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileMaximumInformation'})]], } ], - '__unnamed_186e' : [ 0x10, { + '__unnamed_1873' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileMaximumInformation'})]], 'FileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], @@ -4491,207 +4491,207 @@ nt_types = { 'ClusterCount' : [ 0xc, ['unsigned long']], 'DeleteHandle' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1870' : [ 0x10, { + '__unnamed_1875' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'EaList' : [ 0x4, ['pointer', ['void']]], 'EaListLength' : [ 0x8, ['unsigned long']], 'EaIndex' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1872' : [ 0x4, { + '__unnamed_1877' : [ 0x4, { 'Length' : [ 0x0, ['unsigned long']], } ], - '__unnamed_1876' : [ 0x8, { + '__unnamed_187b' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'FsInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsMaximumInformation'})]], } ], - '__unnamed_1878' : [ 0x10, { + '__unnamed_187d' : [ 0x10, { 'OutputBufferLength' : [ 0x0, ['unsigned long']], 'InputBufferLength' : [ 0x4, ['unsigned long']], 'FsControlCode' : [ 0x8, ['unsigned long']], 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_187a' : [ 0x10, { + '__unnamed_187f' : [ 0x10, { 'Length' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], 'Key' : [ 0x4, ['unsigned long']], 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], } ], - '__unnamed_187c' : [ 0x10, { + '__unnamed_1881' : [ 0x10, { 'OutputBufferLength' : [ 0x0, ['unsigned long']], 'InputBufferLength' : [ 0x4, ['unsigned long']], 'IoControlCode' : [ 0x8, ['unsigned long']], 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_187e' : [ 0x8, { + '__unnamed_1883' : [ 0x8, { 'SecurityInformation' : [ 0x0, ['unsigned long']], 'Length' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1880' : [ 0x8, { + '__unnamed_1885' : [ 0x8, { 'SecurityInformation' : [ 0x0, ['unsigned long']], 'SecurityDescriptor' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_1882' : [ 0x8, { + '__unnamed_1887' : [ 0x8, { 'Vpb' : [ 0x0, ['pointer', ['_VPB']]], 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], } ], - '__unnamed_1886' : [ 0x4, { + '__unnamed_188b' : [ 0x4, { 'Srb' : [ 0x0, ['pointer', ['_SCSI_REQUEST_BLOCK']]], } ], - '__unnamed_188a' : [ 0x10, { + '__unnamed_188f' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'StartSid' : [ 0x4, ['pointer', ['void']]], 'SidList' : [ 0x8, ['pointer', ['_FILE_GET_QUOTA_INFORMATION']]], 'SidListLength' : [ 0xc, ['unsigned long']], } ], - '__unnamed_188e' : [ 0x4, { + '__unnamed_1893' : [ 0x4, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations'})]], } ], - '__unnamed_1890' : [ 0x10, { + '__unnamed_1895' : [ 0x10, { 'InterfaceType' : [ 0x0, ['pointer', ['_GUID']]], 'Size' : [ 0x4, ['unsigned short']], 'Version' : [ 0x6, ['unsigned short']], 'Interface' : [ 0x8, ['pointer', ['_INTERFACE']]], 'InterfaceSpecificData' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1894' : [ 0x4, { + '__unnamed_1899' : [ 0x4, { 'Capabilities' : [ 0x0, ['pointer', ['_DEVICE_CAPABILITIES']]], } ], - '__unnamed_1896' : [ 0x4, { + '__unnamed_189b' : [ 0x4, { 'IoResourceRequirementList' : [ 0x0, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], } ], - '__unnamed_1898' : [ 0x10, { + '__unnamed_189d' : [ 0x10, { 'WhichSpace' : [ 0x0, ['unsigned long']], 'Buffer' : [ 0x4, ['pointer', ['void']]], 'Offset' : [ 0x8, ['unsigned long']], 'Length' : [ 0xc, ['unsigned long']], } ], - '__unnamed_189a' : [ 0x1, { + '__unnamed_189f' : [ 0x1, { 'Lock' : [ 0x0, ['unsigned char']], } ], - '__unnamed_189e' : [ 0x4, { + '__unnamed_18a3' : [ 0x4, { 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber'})]], } ], - '__unnamed_18a2' : [ 0x8, { + '__unnamed_18a7' : [ 0x8, { 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], 'LocaleId' : [ 0x4, ['unsigned long']], } ], - '__unnamed_18a6' : [ 0x8, { + '__unnamed_18ab' : [ 0x8, { 'InPath' : [ 0x0, ['unsigned char']], 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile'})]], } ], - '__unnamed_18a8' : [ 0x4, { + '__unnamed_18ad' : [ 0x4, { 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], } ], - '__unnamed_18ac' : [ 0x4, { + '__unnamed_18b1' : [ 0x4, { 'PowerSequence' : [ 0x0, ['pointer', ['_POWER_SEQUENCE']]], } ], - '__unnamed_18b0' : [ 0x10, { + '__unnamed_18b5' : [ 0x10, { 'SystemContext' : [ 0x0, ['unsigned long']], 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], 'State' : [ 0x8, ['_POWER_STATE']], 'ShutdownType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], } ], - '__unnamed_18b2' : [ 0x8, { + '__unnamed_18b7' : [ 0x8, { 'AllocatedResources' : [ 0x0, ['pointer', ['_CM_RESOURCE_LIST']]], 'AllocatedResourcesTranslated' : [ 0x4, ['pointer', ['_CM_RESOURCE_LIST']]], } ], - '__unnamed_18b4' : [ 0x10, { + '__unnamed_18b9' : [ 0x10, { 'ProviderId' : [ 0x0, ['unsigned long']], 'DataPath' : [ 0x4, ['pointer', ['void']]], 'BufferSize' : [ 0x8, ['unsigned long']], 'Buffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_18b6' : [ 0x10, { + '__unnamed_18bb' : [ 0x10, { 'Argument1' : [ 0x0, ['pointer', ['void']]], 'Argument2' : [ 0x4, ['pointer', ['void']]], 'Argument3' : [ 0x8, ['pointer', ['void']]], 'Argument4' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_18b8' : [ 0x10, { - 'Create' : [ 0x0, ['__unnamed_185a']], - 'CreatePipe' : [ 0x0, ['__unnamed_185e']], - 'CreateMailslot' : [ 0x0, ['__unnamed_1862']], - 'Read' : [ 0x0, ['__unnamed_1864']], - 'Write' : [ 0x0, ['__unnamed_1864']], - 'QueryDirectory' : [ 0x0, ['__unnamed_1868']], - 'NotifyDirectory' : [ 0x0, ['__unnamed_186a']], - 'QueryFile' : [ 0x0, ['__unnamed_186c']], - 'SetFile' : [ 0x0, ['__unnamed_186e']], - 'QueryEa' : [ 0x0, ['__unnamed_1870']], - 'SetEa' : [ 0x0, ['__unnamed_1872']], - 'QueryVolume' : [ 0x0, ['__unnamed_1876']], - 'SetVolume' : [ 0x0, ['__unnamed_1876']], - 'FileSystemControl' : [ 0x0, ['__unnamed_1878']], - 'LockControl' : [ 0x0, ['__unnamed_187a']], - 'DeviceIoControl' : [ 0x0, ['__unnamed_187c']], - 'QuerySecurity' : [ 0x0, ['__unnamed_187e']], - 'SetSecurity' : [ 0x0, ['__unnamed_1880']], - 'MountVolume' : [ 0x0, ['__unnamed_1882']], - 'VerifyVolume' : [ 0x0, ['__unnamed_1882']], - 'Scsi' : [ 0x0, ['__unnamed_1886']], - 'QueryQuota' : [ 0x0, ['__unnamed_188a']], - 'SetQuota' : [ 0x0, ['__unnamed_1872']], - 'QueryDeviceRelations' : [ 0x0, ['__unnamed_188e']], - 'QueryInterface' : [ 0x0, ['__unnamed_1890']], - 'DeviceCapabilities' : [ 0x0, ['__unnamed_1894']], - 'FilterResourceRequirements' : [ 0x0, ['__unnamed_1896']], - 'ReadWriteConfig' : [ 0x0, ['__unnamed_1898']], - 'SetLock' : [ 0x0, ['__unnamed_189a']], - 'QueryId' : [ 0x0, ['__unnamed_189e']], - 'QueryDeviceText' : [ 0x0, ['__unnamed_18a2']], - 'UsageNotification' : [ 0x0, ['__unnamed_18a6']], - 'WaitWake' : [ 0x0, ['__unnamed_18a8']], - 'PowerSequence' : [ 0x0, ['__unnamed_18ac']], - 'Power' : [ 0x0, ['__unnamed_18b0']], - 'StartDevice' : [ 0x0, ['__unnamed_18b2']], - 'WMI' : [ 0x0, ['__unnamed_18b4']], - 'Others' : [ 0x0, ['__unnamed_18b6']], + '__unnamed_18bd' : [ 0x10, { + 'Create' : [ 0x0, ['__unnamed_185f']], + 'CreatePipe' : [ 0x0, ['__unnamed_1863']], + 'CreateMailslot' : [ 0x0, ['__unnamed_1867']], + 'Read' : [ 0x0, ['__unnamed_1869']], + 'Write' : [ 0x0, ['__unnamed_1869']], + 'QueryDirectory' : [ 0x0, ['__unnamed_186d']], + 'NotifyDirectory' : [ 0x0, ['__unnamed_186f']], + 'QueryFile' : [ 0x0, ['__unnamed_1871']], + 'SetFile' : [ 0x0, ['__unnamed_1873']], + 'QueryEa' : [ 0x0, ['__unnamed_1875']], + 'SetEa' : [ 0x0, ['__unnamed_1877']], + 'QueryVolume' : [ 0x0, ['__unnamed_187b']], + 'SetVolume' : [ 0x0, ['__unnamed_187b']], + 'FileSystemControl' : [ 0x0, ['__unnamed_187d']], + 'LockControl' : [ 0x0, ['__unnamed_187f']], + 'DeviceIoControl' : [ 0x0, ['__unnamed_1881']], + 'QuerySecurity' : [ 0x0, ['__unnamed_1883']], + 'SetSecurity' : [ 0x0, ['__unnamed_1885']], + 'MountVolume' : [ 0x0, ['__unnamed_1887']], + 'VerifyVolume' : [ 0x0, ['__unnamed_1887']], + 'Scsi' : [ 0x0, ['__unnamed_188b']], + 'QueryQuota' : [ 0x0, ['__unnamed_188f']], + 'SetQuota' : [ 0x0, ['__unnamed_1877']], + 'QueryDeviceRelations' : [ 0x0, ['__unnamed_1893']], + 'QueryInterface' : [ 0x0, ['__unnamed_1895']], + 'DeviceCapabilities' : [ 0x0, ['__unnamed_1899']], + 'FilterResourceRequirements' : [ 0x0, ['__unnamed_189b']], + 'ReadWriteConfig' : [ 0x0, ['__unnamed_189d']], + 'SetLock' : [ 0x0, ['__unnamed_189f']], + 'QueryId' : [ 0x0, ['__unnamed_18a3']], + 'QueryDeviceText' : [ 0x0, ['__unnamed_18a7']], + 'UsageNotification' : [ 0x0, ['__unnamed_18ab']], + 'WaitWake' : [ 0x0, ['__unnamed_18ad']], + 'PowerSequence' : [ 0x0, ['__unnamed_18b1']], + 'Power' : [ 0x0, ['__unnamed_18b5']], + 'StartDevice' : [ 0x0, ['__unnamed_18b7']], + 'WMI' : [ 0x0, ['__unnamed_18b9']], + 'Others' : [ 0x0, ['__unnamed_18bb']], } ], '_IO_STACK_LOCATION' : [ 0x24, { 'MajorFunction' : [ 0x0, ['unsigned char']], 'MinorFunction' : [ 0x1, ['unsigned char']], 'Flags' : [ 0x2, ['unsigned char']], 'Control' : [ 0x3, ['unsigned char']], - 'Parameters' : [ 0x4, ['__unnamed_18b8']], + 'Parameters' : [ 0x4, ['__unnamed_18bd']], 'DeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], 'FileObject' : [ 0x18, ['pointer', ['_FILE_OBJECT']]], 'CompletionRoutine' : [ 0x1c, ['pointer', ['void']]], 'Context' : [ 0x20, ['pointer', ['void']]], } ], - '__unnamed_18bf' : [ 0x18, { + '__unnamed_18c4' : [ 0x18, { 'Length' : [ 0x0, ['unsigned long']], 'Alignment' : [ 0x4, ['unsigned long']], 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], } ], - '__unnamed_18c1' : [ 0x8, { + '__unnamed_18c6' : [ 0x8, { 'MinimumVector' : [ 0x0, ['unsigned long']], 'MaximumVector' : [ 0x4, ['unsigned long']], } ], - '__unnamed_18c3' : [ 0x8, { + '__unnamed_18c8' : [ 0x8, { 'MinimumChannel' : [ 0x0, ['unsigned long']], 'MaximumChannel' : [ 0x4, ['unsigned long']], } ], - '__unnamed_18c5' : [ 0x10, { + '__unnamed_18ca' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'MinBusNumber' : [ 0x4, ['unsigned long']], 'MaxBusNumber' : [ 0x8, ['unsigned long']], 'Reserved' : [ 0xc, ['unsigned long']], } ], - '__unnamed_18c7' : [ 0xc, { + '__unnamed_18cc' : [ 0xc, { 'Priority' : [ 0x0, ['unsigned long']], 'Reserved1' : [ 0x4, ['unsigned long']], 'Reserved2' : [ 0x8, ['unsigned long']], } ], - '__unnamed_18c9' : [ 0x18, { - 'Port' : [ 0x0, ['__unnamed_18bf']], - 'Memory' : [ 0x0, ['__unnamed_18bf']], - 'Interrupt' : [ 0x0, ['__unnamed_18c1']], - 'Dma' : [ 0x0, ['__unnamed_18c3']], - 'Generic' : [ 0x0, ['__unnamed_18bf']], - 'DevicePrivate' : [ 0x0, ['__unnamed_1619']], - 'BusNumber' : [ 0x0, ['__unnamed_18c5']], - 'ConfigData' : [ 0x0, ['__unnamed_18c7']], + '__unnamed_18ce' : [ 0x18, { + 'Port' : [ 0x0, ['__unnamed_18c4']], + 'Memory' : [ 0x0, ['__unnamed_18c4']], + 'Interrupt' : [ 0x0, ['__unnamed_18c6']], + 'Dma' : [ 0x0, ['__unnamed_18c8']], + 'Generic' : [ 0x0, ['__unnamed_18c4']], + 'DevicePrivate' : [ 0x0, ['__unnamed_161d']], + 'BusNumber' : [ 0x0, ['__unnamed_18ca']], + 'ConfigData' : [ 0x0, ['__unnamed_18cc']], } ], '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { 'Option' : [ 0x0, ['unsigned char']], @@ -4700,30 +4700,30 @@ nt_types = { 'Spare1' : [ 0x3, ['unsigned char']], 'Flags' : [ 0x4, ['unsigned short']], 'Spare2' : [ 0x6, ['unsigned short']], - 'u' : [ 0x8, ['__unnamed_18c9']], + 'u' : [ 0x8, ['__unnamed_18ce']], } ], '_MI_VERIFIER_POOL_HEADER' : [ 0x4, { 'VerifierPoolEntry' : [ 0x0, ['pointer', ['_VI_POOL_ENTRY']]], } ], - '__unnamed_18d2' : [ 0x4, { + '__unnamed_18d7' : [ 0x4, { 'DataLength' : [ 0x0, ['short']], 'TotalLength' : [ 0x2, ['short']], } ], - '__unnamed_18d4' : [ 0x4, { - 's1' : [ 0x0, ['__unnamed_18d2']], + '__unnamed_18d9' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_18d7']], 'Length' : [ 0x0, ['unsigned long']], } ], - '__unnamed_18d6' : [ 0x4, { + '__unnamed_18db' : [ 0x4, { 'Type' : [ 0x0, ['short']], 'DataInfoOffset' : [ 0x2, ['short']], } ], - '__unnamed_18d8' : [ 0x4, { - 's2' : [ 0x0, ['__unnamed_18d6']], + '__unnamed_18dd' : [ 0x4, { + 's2' : [ 0x0, ['__unnamed_18db']], 'ZeroInit' : [ 0x0, ['unsigned long']], } ], '_PORT_MESSAGE' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_18d4']], - 'u2' : [ 0x4, ['__unnamed_18d8']], + 'u1' : [ 0x0, ['__unnamed_18d9']], + 'u2' : [ 0x4, ['__unnamed_18dd']], 'ClientId' : [ 0x8, ['_CLIENT_ID']], 'DoNotUseThisField' : [ 0x8, ['double']], 'MessageId' : [ 0x10, ['unsigned long']], @@ -4861,26 +4861,26 @@ nt_types = { 'Parameter3' : [ 0xc, ['unsigned long']], 'Parameter4' : [ 0x10, ['unsigned long']], } ], - '__unnamed_1913' : [ 0x4, { - 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32)]], + '__unnamed_1918' : [ 0x4, { + 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], } ], - '__unnamed_1915' : [ 0x4, { - 'bits' : [ 0x0, ['__unnamed_1913']], + '__unnamed_191a' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_1918']], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_PCI_SLOT_NUMBER' : [ 0x4, { - 'u' : [ 0x0, ['__unnamed_1915']], + 'u' : [ 0x0, ['__unnamed_191a']], } ], '_CM_NOTIFY_BLOCK' : [ 0x2c, { 'HiveList' : [ 0x0, ['_LIST_ENTRY']], 'PostList' : [ 0x8, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x10, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x14, ['pointer', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_SID' : [ 0xc, { @@ -4957,50 +4957,50 @@ nt_types = { 'FsFilterCallbacks' : [ 0x18, ['pointer', ['_FS_FILTER_CALLBACKS']]], } ], '_PM_SUPPORT' : [ 0x1, { - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_TEB_ACTIVE_FRAME_CONTEXT' : [ 0x8, { 'Flags' : [ 0x0, ['unsigned long']], 'FrameName' : [ 0x4, ['pointer', ['unsigned char']]], } ], - '__unnamed_1946' : [ 0xc, { + '__unnamed_194b' : [ 0xc, { 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], 'AllocateFromCount' : [ 0x4, ['unsigned long']], 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], } ], - '__unnamed_1948' : [ 0x4, { + '__unnamed_194d' : [ 0x4, { 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], } ], - '__unnamed_194c' : [ 0x4, { + '__unnamed_1951' : [ 0x4, { 'AllocatedResources' : [ 0x0, ['pointer', ['pointer', ['_CM_PARTIAL_RESOURCE_LIST']]]], } ], - '__unnamed_194e' : [ 0x10, { + '__unnamed_1953' : [ 0x10, { 'PhysicalDeviceObject' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], 'ConflictingResource' : [ 0x4, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], 'ConflictCount' : [ 0x8, ['pointer', ['unsigned long']]], 'Conflicts' : [ 0xc, ['pointer', ['pointer', ['_ARBITER_CONFLICT_INFO']]]], } ], - '__unnamed_1950' : [ 0x4, { + '__unnamed_1955' : [ 0x4, { 'ReserveDevice' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], } ], - '__unnamed_1952' : [ 0x10, { - 'TestAllocation' : [ 0x0, ['__unnamed_1946']], - 'RetestAllocation' : [ 0x0, ['__unnamed_1946']], - 'BootAllocation' : [ 0x0, ['__unnamed_1948']], - 'QueryAllocatedResources' : [ 0x0, ['__unnamed_194c']], - 'QueryConflict' : [ 0x0, ['__unnamed_194e']], - 'QueryArbitrate' : [ 0x0, ['__unnamed_1948']], - 'AddReserved' : [ 0x0, ['__unnamed_1950']], + '__unnamed_1957' : [ 0x10, { + 'TestAllocation' : [ 0x0, ['__unnamed_194b']], + 'RetestAllocation' : [ 0x0, ['__unnamed_194b']], + 'BootAllocation' : [ 0x0, ['__unnamed_194d']], + 'QueryAllocatedResources' : [ 0x0, ['__unnamed_1951']], + 'QueryConflict' : [ 0x0, ['__unnamed_1953']], + 'QueryArbitrate' : [ 0x0, ['__unnamed_194d']], + 'AddReserved' : [ 0x0, ['__unnamed_1955']], } ], '_ARBITER_PARAMETERS' : [ 0x10, { - 'Parameters' : [ 0x0, ['__unnamed_1952']], + 'Parameters' : [ 0x0, ['__unnamed_1957']], } ], '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { 'AuditMask' : [ 0x0, ['unsigned long']], @@ -5078,25 +5078,25 @@ nt_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -5126,47 +5126,47 @@ nt_types = { 'ContentionCount' : [ 0x14, ['unsigned long']], 'Spare' : [ 0x18, ['array', 2, ['unsigned long']]], } ], - '__unnamed_1975' : [ 0x14, { + '__unnamed_197a' : [ 0x14, { 'ClassGuid' : [ 0x0, ['_GUID']], 'SymbolicLinkName' : [ 0x10, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1977' : [ 0x2, { + '__unnamed_197c' : [ 0x2, { 'DeviceIds' : [ 0x0, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1979' : [ 0x2, { + '__unnamed_197e' : [ 0x2, { 'DeviceId' : [ 0x0, ['array', 1, ['unsigned short']]], } ], - '__unnamed_197b' : [ 0x8, { + '__unnamed_1980' : [ 0x8, { 'NotificationStructure' : [ 0x0, ['pointer', ['void']]], 'DeviceIds' : [ 0x4, ['array', 1, ['unsigned short']]], } ], - '__unnamed_197d' : [ 0x4, { + '__unnamed_1982' : [ 0x4, { 'Notification' : [ 0x0, ['pointer', ['void']]], } ], - '__unnamed_197f' : [ 0x8, { + '__unnamed_1984' : [ 0x8, { 'NotificationCode' : [ 0x0, ['unsigned long']], 'NotificationData' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1981' : [ 0x8, { + '__unnamed_1986' : [ 0x8, { 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1983' : [ 0x10, { + '__unnamed_1988' : [ 0x10, { 'BlockedDriverGuid' : [ 0x0, ['_GUID']], } ], - '__unnamed_1985' : [ 0x2, { + '__unnamed_198a' : [ 0x2, { 'ParentId' : [ 0x0, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1987' : [ 0x14, { - 'DeviceClass' : [ 0x0, ['__unnamed_1975']], - 'TargetDevice' : [ 0x0, ['__unnamed_1977']], - 'InstallDevice' : [ 0x0, ['__unnamed_1979']], - 'CustomNotification' : [ 0x0, ['__unnamed_197b']], - 'ProfileNotification' : [ 0x0, ['__unnamed_197d']], - 'PowerNotification' : [ 0x0, ['__unnamed_197f']], - 'VetoNotification' : [ 0x0, ['__unnamed_1981']], - 'BlockedDriverNotification' : [ 0x0, ['__unnamed_1983']], - 'InvalidIDNotification' : [ 0x0, ['__unnamed_1985']], + '__unnamed_198c' : [ 0x14, { + 'DeviceClass' : [ 0x0, ['__unnamed_197a']], + 'TargetDevice' : [ 0x0, ['__unnamed_197c']], + 'InstallDevice' : [ 0x0, ['__unnamed_197e']], + 'CustomNotification' : [ 0x0, ['__unnamed_1980']], + 'ProfileNotification' : [ 0x0, ['__unnamed_1982']], + 'PowerNotification' : [ 0x0, ['__unnamed_1984']], + 'VetoNotification' : [ 0x0, ['__unnamed_1986']], + 'BlockedDriverNotification' : [ 0x0, ['__unnamed_1988']], + 'InvalidIDNotification' : [ 0x0, ['__unnamed_198a']], } ], '_PLUGPLAY_EVENT_BLOCK' : [ 0x38, { 'EventGuid' : [ 0x0, ['_GUID']], @@ -5175,7 +5175,7 @@ nt_types = { 'Flags' : [ 0x18, ['unsigned long']], 'TotalSize' : [ 0x1c, ['unsigned long']], 'DeviceObject' : [ 0x20, ['pointer', ['void']]], - 'u' : [ 0x24, ['__unnamed_1987']], + 'u' : [ 0x24, ['__unnamed_198c']], } ], '_CACHED_CHILD_LIST' : [ 0x8, { 'Count' : [ 0x0, ['unsigned long']], @@ -5186,16 +5186,16 @@ nt_types = { 'Range' : [ 0x0, ['_PO_MEMORY_RANGE_ARRAY_RANGE']], 'Link' : [ 0x0, ['_PO_MEMORY_RANGE_ARRAY_LINK']], } ], - '__unnamed_199e' : [ 0x8, { + '__unnamed_19a3' : [ 0x8, { 'Signature' : [ 0x0, ['unsigned long']], 'CheckSum' : [ 0x4, ['unsigned long']], } ], - '__unnamed_19a0' : [ 0x10, { + '__unnamed_19a5' : [ 0x10, { 'DiskId' : [ 0x0, ['_GUID']], } ], - '__unnamed_19a2' : [ 0x10, { - 'Mbr' : [ 0x0, ['__unnamed_199e']], - 'Gpt' : [ 0x0, ['__unnamed_19a0']], + '__unnamed_19a7' : [ 0x10, { + 'Mbr' : [ 0x0, ['__unnamed_19a3']], + 'Gpt' : [ 0x0, ['__unnamed_19a5']], } ], '_DUMP_INITIALIZATION_CONTEXT' : [ 0x70, { 'Length' : [ 0x0, ['unsigned long']], @@ -5216,7 +5216,7 @@ nt_types = { 'TargetAddress' : [ 0x50, ['pointer', ['void']]], 'WritePendingRoutine' : [ 0x54, ['pointer', ['void']]], 'PartitionStyle' : [ 0x58, ['unsigned long']], - 'DiskInfo' : [ 0x5c, ['__unnamed_19a2']], + 'DiskInfo' : [ 0x5c, ['__unnamed_19a7']], } ], '_IO_CLIENT_EXTENSION' : [ 0x8, { 'NextExtension' : [ 0x0, ['pointer', ['_IO_CLIENT_EXTENSION']]], @@ -5313,7 +5313,7 @@ nt_types = { 'ReadyS0' : [ 0x38, ['_LIST_ENTRY']], 'WaitS0' : [ 0x40, ['_LIST_ENTRY']], } ], - '__unnamed_19d2' : [ 0x8, { + '__unnamed_19d7' : [ 0x8, { 'Base' : [ 0x0, ['unsigned long']], 'Limit' : [ 0x4, ['unsigned long']], } ], @@ -5326,7 +5326,7 @@ nt_types = { 'SecondaryBus' : [ 0x9, ['unsigned char']], 'SubordinateBus' : [ 0xa, ['unsigned char']], 'SecondaryLatency' : [ 0xb, ['unsigned char']], - 'Range' : [ 0xc, ['array', 4, ['__unnamed_19d2']]], + 'Range' : [ 0xc, ['array', 4, ['__unnamed_19d7']]], 'InterruptLine' : [ 0x2c, ['unsigned char']], 'InterruptPin' : [ 0x2d, ['unsigned char']], 'BridgeControl' : [ 0x2e, ['unsigned short']], @@ -5591,18 +5591,18 @@ nt_types = { 'ModifiedId' : [ 0x10, ['_LUID']], 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], } ], - '__unnamed_1a60' : [ 0x8, { + '__unnamed_1a65' : [ 0x8, { 'EndingOffset' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], 'ResourceToRelease' : [ 0x4, ['pointer', ['pointer', ['_ERESOURCE']]]], } ], - '__unnamed_1a62' : [ 0x4, { + '__unnamed_1a67' : [ 0x4, { 'ResourceToRelease' : [ 0x0, ['pointer', ['_ERESOURCE']]], } ], - '__unnamed_1a66' : [ 0x8, { + '__unnamed_1a6b' : [ 0x8, { 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], 'PageProtection' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1a68' : [ 0x14, { + '__unnamed_1a6d' : [ 0x14, { 'Argument1' : [ 0x0, ['pointer', ['void']]], 'Argument2' : [ 0x4, ['pointer', ['void']]], 'Argument3' : [ 0x8, ['pointer', ['void']]], @@ -5610,10 +5610,10 @@ nt_types = { 'Argument5' : [ 0x10, ['pointer', ['void']]], } ], '_FS_FILTER_PARAMETERS' : [ 0x14, { - 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_1a60']], - 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_1a62']], - 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_1a66']], - 'Others' : [ 0x0, ['__unnamed_1a68']], + 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_1a65']], + 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_1a67']], + 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_1a6b']], + 'Others' : [ 0x0, ['__unnamed_1a6d']], } ], '_COMPRESSED_DATA_INFO' : [ 0xc, { 'CompressionFormatAndEngine' : [ 0x0, ['unsigned short']], @@ -5648,15 +5648,5 @@ nt_types = { 'ReferenceCount' : [ 0xc, ['unsigned long']], 'DescriptorLength' : [ 0x10, ['unsigned long']], 'Descriptor' : [ 0x14, ['_SECURITY_DESCRIPTOR_RELATIVE']], -} ], - '_MMFREE_POOL_ENTRY' : [ 0x14, { - 'List' : [ 0x0, ['_LIST_ENTRY']], - 'Size' : [ 0x8, ['unsigned long']], - 'Signature' : [ 0xc, ['unsigned long']], - 'Owner' : [ 0x10, ['pointer', ['_MMFREE_POOL_ENTRY']]], -} ], - '_SYSPTES_HEADER' : [ 0xc, { - 'ListHead' : [ 0x0, ['_LIST_ENTRY']], - 'Count' : [ 0x8, ['unsigned long']], } ], } diff --git a/volatility/plugins/overlays/windows/win2003_sp2_x64_vtypes.py b/volatility/plugins/overlays/windows/win2003_sp2_x64_vtypes.py index a274df98..af851792 100644 --- a/volatility/plugins/overlays/windows/win2003_sp2_x64_vtypes.py +++ b/volatility/plugins/overlays/windows/win2003_sp2_x64_vtypes.py @@ -232,10 +232,10 @@ ntkrnlmp_types = { 'Teb' : [ 0xb0, ['pointer64', ['void']]], 'Timer' : [ 0xb8, ['_KTIMER']], 'TimerFill' : [ 0xb8, ['array', 60, ['unsigned char']]], - 'AutoAlignment' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'GuiThread' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ReservedFlags' : [ 0xf4, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'AutoAlignment' : [ 0xf4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0xf4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'GuiThread' : [ 0xf4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xf4, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'ThreadFlags' : [ 0xf4, ['long']], 'WaitBlock' : [ 0xf8, ['array', 4, ['_KWAIT_BLOCK']]], 'WaitBlockFill0' : [ 0xf8, ['array', 43, ['unsigned char']]], @@ -374,15 +374,15 @@ ntkrnlmp_types = { } ], '_EX_FAST_REF' : [ 0x8, { 'Object' : [ 0x0, ['pointer64', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], } ], '_EX_PUSH_LOCK' : [ 0x8, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], 'Ptr' : [ 0x0, ['pointer64', ['void']]], } ], @@ -432,31 +432,31 @@ ntkrnlmp_types = { 'ReadClusterSize' : [ 0x3f4, ['unsigned long']], 'GrantedAccess' : [ 0x3f8, ['unsigned long']], 'CrossThreadFlags' : [ 0x3fc, ['unsigned long']], - 'Terminated' : [ 0x3fc, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeadThread' : [ 0x3fc, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x3fc, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x3fc, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x3fc, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x3fc, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x3fc, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x3fc, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x3fc, ['BitField', dict(start_bit = 8, end_bit = 9)]], + 'Terminated' : [ 0x3fc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeadThread' : [ 0x3fc, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x3fc, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x3fc, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x3fc, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x3fc, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x3fc, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x3fc, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x3fc, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x400, ['unsigned long']], - 'ActiveExWorker' : [ 0x400, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x400, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x400, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'KeyedEventInUse' : [ 0x400, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'ActiveExWorker' : [ 0x400, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x400, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x400, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x400, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x404, ['unsigned long']], - 'LpcReceivedMsgIdValid' : [ 0x404, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LpcExitThreadCalled' : [ 0x404, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'AddressSpaceOwner' : [ 0x404, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x404, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x404, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemWorkingSetExclusive' : [ 0x404, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemWorkingSetShared' : [ 0x404, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x404, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x405, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ApcNeeded' : [ 0x405, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'LpcReceivedMsgIdValid' : [ 0x404, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'LpcExitThreadCalled' : [ 0x404, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'AddressSpaceOwner' : [ 0x404, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x404, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x404, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemWorkingSetExclusive' : [ 0x404, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemWorkingSetShared' : [ 0x404, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x404, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x405, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ApcNeeded' : [ 0x405, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], 'ForwardClusterOnly' : [ 0x408, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x409, ['unsigned char']], 'ActiveFaultCount' : [ 0x40a, ['unsigned char']], @@ -531,35 +531,35 @@ ntkrnlmp_types = { 'ModifiedPageCount' : [ 0x380, ['unsigned long']], 'JobStatus' : [ 0x384, ['unsigned long']], 'Flags' : [ 0x388, ['unsigned long']], - 'CreateReported' : [ 0x388, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x388, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x388, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x388, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x388, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x388, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x388, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x388, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x388, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x388, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x388, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x388, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x388, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'SessionCreationUnderway' : [ 0x388, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x388, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x388, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x388, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x388, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x388, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x388, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x388, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x388, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x388, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x388, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'SmapAllowed' : [ 0x388, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'CreateFailed' : [ 0x388, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x388, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'Spare1' : [ 0x388, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'Spare2' : [ 0x388, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x388, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x388, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x388, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x388, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x388, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x388, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x388, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x388, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x388, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x388, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x388, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x388, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x388, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'SessionCreationUnderway' : [ 0x388, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x388, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x388, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x388, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x388, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x388, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x388, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x388, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x388, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x388, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x388, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SmapAllowed' : [ 0x388, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'CreateFailed' : [ 0x388, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x388, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'Spare1' : [ 0x388, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Spare2' : [ 0x388, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x38c, ['long']], 'NextPageColor' : [ 0x390, ['unsigned short']], 'SubSystemMinorVersion' : [ 0x392, ['unsigned char']], @@ -679,12 +679,12 @@ ntkrnlmp_types = { } ], '__unnamed_1179' : [ 0x8, { 'EntireFrame' : [ 0x0, ['unsigned long long']], - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 57)]], - 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58)]], - 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 60)]], - 'Priority' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 63)]], - 'MustBeCached' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 57, native_type='unsigned long long')]], + 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58, native_type='unsigned long long')]], + 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 60, native_type='unsigned long long')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 63, native_type='unsigned long long')]], + 'MustBeCached' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_MMPFN' : [ 0x30, { 'u1' : [ 0x0, ['__unnamed_116a']], @@ -697,7 +697,7 @@ ntkrnlmp_types = { 'u4' : [ 0x28, ['__unnamed_1179']], } ], '__unnamed_1180' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMVAD']]], } ], '__unnamed_1183' : [ 0x8, { @@ -722,9 +722,9 @@ ntkrnlmp_types = { } ], '_MM_AVL_TABLE' : [ 0x40, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'NodeHint' : [ 0x30, ['pointer64', ['void']]], 'NodeFreeHint' : [ 0x38, ['pointer64', ['void']]], } ], @@ -758,10 +758,10 @@ ntkrnlmp_types = { 'Entry' : [ 0x40, ['array', 2, ['pointer64', ['_MMMOD_WRITER_MDL_ENTRY']]]], 'PageFileName' : [ 0x50, ['_UNICODE_STRING']], 'Bitmap' : [ 0x60, ['pointer64', ['_RTL_BITMAP']]], - 'PageFileNumber' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'ReferenceCount' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'BootPartition' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Reserved' : [ 0x68, ['BitField', dict(start_bit = 9, end_bit = 32)]], + 'PageFileNumber' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'ReferenceCount' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'BootPartition' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Reserved' : [ 0x68, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], 'FileHandle' : [ 0x70, ['pointer64', ['void']]], } ], '_EXCEPTION_RECORD' : [ 0x98, { @@ -834,10 +834,10 @@ ntkrnlmp_types = { 'ThreadListHead' : [ 0x70, ['_LIST_ENTRY']], 'ProcessLock' : [ 0x80, ['unsigned long long']], 'Affinity' : [ 0x88, ['unsigned long long']], - 'AutoAlignment' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ReservedFlags' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'AutoAlignment' : [ 0x90, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x90, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x90, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ReservedFlags' : [ 0x90, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='long')]], 'ProcessFlags' : [ 0x90, ['long']], 'BasePriority' : [ 0x94, ['unsigned char']], 'QuantumReset' : [ 0x95, ['unsigned char']], @@ -1689,13 +1689,13 @@ ntkrnlmp_types = { 'NextHandleNeedingPool' : [ 0x64, ['unsigned long']], 'HandleCount' : [ 0x68, ['long']], 'Flags' : [ 0x6c, ['unsigned long']], - 'StrictFIFO' : [ 0x6c, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x6c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], } ], '_POOL_HEADER' : [ 0x10, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'ProcessBilled' : [ 0x8, ['pointer64', ['_EPROCESS']]], @@ -1703,15 +1703,15 @@ ntkrnlmp_types = { 'PoolTagHash' : [ 0xa, ['unsigned short']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_TEB_ACTIVE_FRAME' : [ 0x18, { 'Flags' : [ 0x0, ['unsigned long']], @@ -1737,13 +1737,13 @@ ntkrnlmp_types = { 'Reserved4' : [ 0x1a0, ['array', 96, ['unsigned char']]], } ], '_MMPTE_PROTOTYPE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_MMSUPPORT' : [ 0x58, { 'WorkingSetExpansionLinks' : [ 0x0, ['_LIST_ENTRY']], @@ -1771,14 +1771,14 @@ ntkrnlmp_types = { 'Info' : [ 0x50, ['EX_QUEUE_WORKER_INFO']], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20)]], - 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20, native_type='unsigned long')]], + 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], } ], '_KMUTANT' : [ 0x38, { 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], @@ -1940,22 +1940,22 @@ ntkrnlmp_types = { 'Characteristics' : [ 0x12, ['unsigned short']], } ], '_MMPTE_HARDWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Writable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Writable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x10, { 'Port' : [ 0x0, ['pointer64', ['void']]], @@ -1977,38 +1977,38 @@ ntkrnlmp_types = { 'ContextFlags' : [ 0x0, ['unsigned long']], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'filler' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'filler' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_DEFERRED_WRITE' : [ 0x50, { 'NodeTypeCode' : [ 0x0, ['short']], @@ -2043,13 +2043,13 @@ ntkrnlmp_types = { 'Allocate' : [ 0x2a, ['unsigned char']], } ], '_MMVAD_FLAGS' : [ 0x8, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51, native_type='unsigned long long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63, native_type='unsigned long long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_PS_IMPERSONATION_INFORMATION' : [ 0x10, { 'Token' : [ 0x0, ['pointer64', ['void']]], @@ -2130,8 +2130,8 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['unsigned long long']], 'ImageBaseAddress' : [ 0x10, ['unsigned long long']], 'Ldr' : [ 0x18, ['unsigned long long']], @@ -2202,11 +2202,11 @@ ntkrnlmp_types = { '_KIDTENTRY64' : [ 0x10, { 'OffsetLow' : [ 0x0, ['unsigned short']], 'Selector' : [ 0x2, ['unsigned short']], - 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned short')]], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned short')]], + 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned short')]], + 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], 'OffsetMiddle' : [ 0x6, ['unsigned short']], 'OffsetHigh' : [ 0x8, ['unsigned long']], 'Reserved1' : [ 0xc, ['unsigned long']], @@ -2315,8 +2315,8 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['pointer64', ['void']]], 'ImageBaseAddress' : [ 0x10, ['pointer64', ['void']]], 'Ldr' : [ 0x18, ['pointer64', ['_PEB_LDR_DATA']]], @@ -2403,14 +2403,14 @@ ntkrnlmp_types = { 'FrameName' : [ 0x8, ['pointer64', ['unsigned char']]], } ], '_MMPTE_SOFTWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { 'ListSize' : [ 0x0, ['unsigned long']], @@ -2627,16 +2627,16 @@ ntkrnlmp_types = { 'DataValueHigh' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11)]], - 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned short')]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11, native_type='unsigned short')]], + 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14, native_type='unsigned short')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned short')]], + 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], } ], '_IO_COUNTERS' : [ 0x30, { 'ReadOperationCount' : [ 0x0, ['unsigned long long']], @@ -2670,24 +2670,24 @@ ntkrnlmp_types = { 'Volume' : [ 0x70, ['_LIST_ENTRY']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Available0' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'MemoryPriority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'GrowWsleHash' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AcquiredUnsafe' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Available' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Available0' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'GrowWsleHash' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'AcquiredUnsafe' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Available' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'PROCESSOR_PERF_STATE' : [ 0x20, { @@ -2785,8 +2785,8 @@ ntkrnlmp_types = { 'Revision' : [ 0x0, ['unsigned long']], 'DynamicThrottle' : [ 0x4, ['unsigned char']], 'Spare' : [ 0x5, ['array', 3, ['unsigned char']]], - 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'PolicyCount' : [ 0xc, ['unsigned long']], 'Policy' : [ 0x10, ['array', 3, ['_PROCESSOR_POWER_POLICY_INFO']]], } ], @@ -2935,14 +2935,14 @@ ntkrnlmp_types = { '_tmpfname' : [ 0x28, ['pointer64', ['unsigned char']]], } ], '_MMPTE_LIST' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_CMHIVE' : [ 0xab8, { 'Hive' : [ 0x0, ['_HHIVE']], @@ -3043,9 +3043,9 @@ ntkrnlmp_types = { 'Name' : [ 0x10, ['array', 1, ['unsigned short']]], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x1c, { 'Version' : [ 0x0, ['unsigned short']], @@ -3066,10 +3066,10 @@ ntkrnlmp_types = { 'SecurityQualityOfService' : [ 0x38, ['_SECURITY_QUALITY_OF_SERVICE']], } ], '_WMI_BUFFER_STATE' : [ 0x4, { - 'Free' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InUse' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Flush' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Free' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'InUse' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Flush' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], } ], '_MMFREE_POOL_ENTRY' : [ 0x28, { 'List' : [ 0x0, ['_LIST_ENTRY']], @@ -3123,8 +3123,8 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['unsigned long']], 'ImageBaseAddress' : [ 0x8, ['unsigned long']], 'Ldr' : [ 0xc, ['unsigned long']], @@ -3228,8 +3228,8 @@ ntkrnlmp_types = { 'DeviceListHead' : [ 0x8, ['_LIST_ENTRY']], 'Lock' : [ 0x18, ['unsigned long long']], 'Busy' : [ 0x20, ['unsigned char']], - 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='long long')]], + 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='long long')]], } ], '_KUSER_SHARED_DATA' : [ 0x378, { 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], @@ -3297,19 +3297,19 @@ ntkrnlmp_types = { 'OkayToCloseProcedure' : [ 0x68, ['pointer64', ['void']]], } ], '_WMI_LOGGER_MODE' : [ 0x4, { - 'SequentialFile' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CircularFile' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'AppendFile' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'RealTime' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'DelayOpenFile' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'BufferOnly' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'PrivateLogger' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'AddHeader' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'UseExisting' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'UseGlobalSequence' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'UseLocalSequence' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'Unused2' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'SequentialFile' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CircularFile' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'AppendFile' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'RealTime' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DelayOpenFile' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'BufferOnly' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'PrivateLogger' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'AddHeader' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'UseExisting' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'UseGlobalSequence' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'UseLocalSequence' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'Unused2' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], } ], '_KPROCESSOR_STATE' : [ 0x5b0, { 'SpecialRegisters' : [ 0x0, ['_KSPECIAL_REGISTERS']], @@ -3338,13 +3338,13 @@ ntkrnlmp_types = { 'u4' : [ 0x60, ['__unnamed_1633']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], } ], '_POOL_DESCRIPTOR' : [ 0x1048, { 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], @@ -3362,22 +3362,22 @@ ntkrnlmp_types = { 'ListHeads' : [ 0x48, ['array', 256, ['_LIST_ENTRY']]], } ], '_HARDWARE_PTE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_WOW64_PROCESS' : [ 0x8, { 'Wow64' : [ 0x0, ['pointer64', ['void']]], @@ -3470,8 +3470,8 @@ ntkrnlmp_types = { 'Handler' : [ 0x8, ['pointer64', ['void']]], } ], '_SEP_AUDIT_POLICY_OVERLAY' : [ 0x8, { - 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36)]], - 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37)]], + 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], } ], '_POOL_TRACKER_BIG_PAGES' : [ 0x18, { 'Va' : [ 0x0, ['pointer64', ['void']]], @@ -3484,12 +3484,12 @@ ntkrnlmp_types = { 'FaultingVa' : [ 0x8, ['pointer64', ['void']]], } ], '_MMPTE_SUBSECTION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_VI_DEADLOCK_NODE' : [ 0xd0, { 'Parent' : [ 0x0, ['pointer64', ['_VI_DEADLOCK_NODE']]], @@ -3499,10 +3499,10 @@ ntkrnlmp_types = { 'FreeListEntry' : [ 0x28, ['_LIST_ENTRY']], 'Root' : [ 0x38, ['pointer64', ['_VI_DEADLOCK_RESOURCE']]], 'ThreadEntry' : [ 0x40, ['pointer64', ['_VI_DEADLOCK_THREAD']]], - 'Active' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x48, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x48, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x48, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x48, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'StackTrace' : [ 0x50, ['array', 8, ['pointer64', ['void']]]], 'ParentStackTrace' : [ 0x90, ['array', 8, ['pointer64', ['void']]]], } ], @@ -3586,22 +3586,22 @@ ntkrnlmp_types = { 'LastExceptionFromRip' : [ 0x4c8, ['unsigned long long']], } ], '_MMPTE_HARDWARE_LARGEPAGE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PAT' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 21)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 40)]], - 'reserved2' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PAT' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 21, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 40, native_type='unsigned long long')]], + 'reserved2' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 64, native_type='unsigned long long')]], } ], '_DBGKD_QUERY_SPECIAL_CALLS' : [ 0x4, { 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], @@ -3874,11 +3874,11 @@ ntkrnlmp_types = { } ], '_CM_KEY_CONTROL_BLOCK' : [ 0xb0, { 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x8, ['unsigned long']], 'NextHash' : [ 0x10, ['pointer64', ['_CM_KEY_HASH']]], @@ -3899,10 +3899,10 @@ ntkrnlmp_types = { 'KcbMaxNameLen' : [ 0x98, ['unsigned short']], 'KcbMaxValueNameLen' : [ 0x9a, ['unsigned short']], 'KcbMaxValueDataLen' : [ 0x9c, ['unsigned long']], - 'KcbUserFlags' : [ 0xa0, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'KcbVirtControlFlags' : [ 0xa0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'KcbDebug' : [ 0xa0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Flags' : [ 0xa0, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'KcbUserFlags' : [ 0xa0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0xa0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0xa0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0xa0, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'RealKeyName' : [ 0xa8, ['pointer64', ['unsigned char']]], } ], '_M128A' : [ 0x10, { @@ -3938,15 +3938,15 @@ ntkrnlmp_types = { 'ResourcesChanged' : [ 0x69, ['unsigned char']], } ], '_SEP_AUDIT_POLICY_CATEGORIES' : [ 0x8, { - 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28)]], - 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], - 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28, native_type='unsigned long')]], + 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], + 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], } ], '_CM_KEY_HASH' : [ 0x20, { 'ConvKey' : [ 0x0, ['unsigned long']], @@ -4096,11 +4096,11 @@ ntkrnlmp_types = { 'NewCell' : [ 0x4, ['unsigned long']], } ], '_PCI_PMC' : [ 0x2, { - 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], 'Support' : [ 0x1, ['_PM_SUPPORT']], } ], '_DBGKD_CONTINUE' : [ 0x4, { @@ -4119,7 +4119,7 @@ ntkrnlmp_types = { 'ContextRecord' : [ 0x8, ['pointer64', ['_CONTEXT']]], } ], '__unnamed_176c' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x28, { @@ -4209,8 +4209,8 @@ ntkrnlmp_types = { } ], '_VI_DEADLOCK_RESOURCE' : [ 0xf8, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockQueuedSpinLock', 7: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer64', ['void']]], 'ThreadOwner' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x18, ['_LIST_ENTRY']], @@ -4257,11 +4257,11 @@ ntkrnlmp_types = { 'PrimaryBus' : [ 0x0, ['unsigned char']], 'SecondaryBus' : [ 0x1, ['unsigned char']], 'SubordinateBus' : [ 0x2, ['unsigned char']], - 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], } ], 'PCI_HEADER_TYPE_DEPENDENT' : [ 0x4, { 'type0' : [ 0x0, ['__unnamed_1795']], @@ -4367,14 +4367,14 @@ ntkrnlmp_types = { 'DeviceObject' : [ 0x28, ['pointer64', ['_DEVICE_OBJECT']]], } ], '_MMWSLENTRY' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_17da' : [ 0x4, { 'BaseMiddle' : [ 0x0, ['unsigned char']], @@ -4383,16 +4383,16 @@ ntkrnlmp_types = { 'BaseHigh' : [ 0x3, ['unsigned char']], } ], '__unnamed_17de' : [ 0x4, { - 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_KGDTENTRY64' : [ 0x10, { 'LimitLow' : [ 0x0, ['unsigned short']], @@ -4750,10 +4750,10 @@ ntkrnlmp_types = { 'Run' : [ 0x10, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], } ], '_SEGMENT_FLAGS' : [ 0x8, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], } ], '_PI_BUS_EXTENSION' : [ 0x70, { 'Flags' : [ 0x0, ['unsigned long']], @@ -4885,10 +4885,10 @@ ntkrnlmp_types = { 'Data' : [ 0x40, ['_PLUGPLAY_EVENT_BLOCK']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], } ], '_PNP_DEVICE_EVENT_LIST' : [ 0x88, { 'Status' : [ 0x0, ['long']], @@ -4897,16 +4897,16 @@ ntkrnlmp_types = { 'List' : [ 0x78, ['_LIST_ENTRY']], } ], '_MMPTE_TRANSITION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 64, native_type='unsigned long long')]], } ], '_KREQUEST_PACKET' : [ 0x20, { 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer64', ['void']]]], @@ -4918,8 +4918,8 @@ ntkrnlmp_types = { 'Buffer' : [ 0x8, ['pointer64', ['unsigned char']]], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_CM_KEY_SECURITY_CACHE' : [ 0x38, { 'Cell' : [ 0x0, ['unsigned long']], @@ -4936,9 +4936,9 @@ ntkrnlmp_types = { 'DemotePercent' : [ 0xc, ['unsigned char']], 'PromotePercent' : [ 0xd, ['unsigned char']], 'Spare' : [ 0xe, ['array', 2, ['unsigned char']]], - 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_ARBITER_INSTANCE' : [ 0x138, { 'Signature' : [ 0x0, ['unsigned long']], @@ -5559,9 +5559,9 @@ ntkrnlmp_types = { 'Parameter4' : [ 0x20, ['unsigned long long']], } ], '__unnamed_19e9' : [ 0x4, { - 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_19eb' : [ 0x4, { 'bits' : [ 0x0, ['__unnamed_19e9']], @@ -5575,9 +5575,9 @@ ntkrnlmp_types = { 'PostList' : [ 0x10, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x20, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x28, ['pointer64', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x38, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_SID' : [ 0xc, { @@ -5654,14 +5654,14 @@ ntkrnlmp_types = { 'FsFilterCallbacks' : [ 0x30, ['pointer64', ['_FS_FILTER_CALLBACKS']]], } ], '_PM_SUPPORT' : [ 0x1, { - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '__unnamed_1a1a' : [ 0x18, { 'ArbitrationList' : [ 0x0, ['pointer64', ['_LIST_ENTRY']]], @@ -5771,25 +5771,25 @@ ntkrnlmp_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -6193,10 +6193,10 @@ ntkrnlmp_types = { 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], 'Security' : [ 0x2c, ['unsigned long']], 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'MaxClassLen' : [ 0x38, ['unsigned long']], 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], 'MaxValueDataLen' : [ 0x40, ['unsigned long']], diff --git a/volatility/plugins/overlays/windows/win2003_sp2_x86_vtypes.py b/volatility/plugins/overlays/windows/win2003_sp2_x86_vtypes.py index 804eafeb..1110fa48 100644 --- a/volatility/plugins/overlays/windows/win2003_sp2_x86_vtypes.py +++ b/volatility/plugins/overlays/windows/win2003_sp2_x86_vtypes.py @@ -1,4 +1,4 @@ -nt_types = { +ntkrnlmp_types = { 'LIST_ENTRY64' : [ 0x10, { 'Flink' : [ 0x0, ['unsigned long long']], 'Blink' : [ 0x8, ['unsigned long long']], @@ -7,136 +7,15 @@ nt_types = { 'Flink' : [ 0x0, ['unsigned long']], 'Blink' : [ 0x4, ['unsigned long']], } ], - '_KSYSTEM_TIME' : [ 0xc, { - 'LowPart' : [ 0x0, ['unsigned long']], - 'High1Time' : [ 0x4, ['long']], - 'High2Time' : [ 0x8, ['long']], -} ], - '_KUSER_SHARED_DATA' : [ 0x378, { - 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], - 'TickCountMultiplier' : [ 0x4, ['unsigned long']], - 'InterruptTime' : [ 0x8, ['_KSYSTEM_TIME']], - 'SystemTime' : [ 0x14, ['_KSYSTEM_TIME']], - 'TimeZoneBias' : [ 0x20, ['_KSYSTEM_TIME']], - 'ImageNumberLow' : [ 0x2c, ['unsigned short']], - 'ImageNumberHigh' : [ 0x2e, ['unsigned short']], - 'NtSystemRoot' : [ 0x30, ['array', 260, ['wchar']]], - 'MaxStackTraceDepth' : [ 0x238, ['unsigned long']], - 'CryptoExponent' : [ 0x23c, ['unsigned long']], - 'TimeZoneId' : [ 0x240, ['unsigned long']], - 'LargePageMinimum' : [ 0x244, ['unsigned long']], - 'Reserved2' : [ 0x248, ['array', 7, ['unsigned long']]], - 'NtProductType' : [ 0x264, ['Enumeration', dict(target = 'long', choices = {1: 'NtProductWinNt', 2: 'NtProductLanManNt', 3: 'NtProductServer'})]], - 'ProductTypeIsValid' : [ 0x268, ['unsigned char']], - 'NtMajorVersion' : [ 0x26c, ['unsigned long']], - 'NtMinorVersion' : [ 0x270, ['unsigned long']], - 'ProcessorFeatures' : [ 0x274, ['array', 64, ['unsigned char']]], - 'Reserved1' : [ 0x2b4, ['unsigned long']], - 'Reserved3' : [ 0x2b8, ['unsigned long']], - 'TimeSlip' : [ 0x2bc, ['unsigned long']], - 'AlternativeArchitecture' : [ 0x2c0, ['Enumeration', dict(target = 'long', choices = {0: 'StandardDesign', 1: 'NEC98x86', 2: 'EndAlternatives'})]], - 'SystemExpirationDate' : [ 0x2c8, ['_LARGE_INTEGER']], - 'SuiteMask' : [ 0x2d0, ['unsigned long']], - 'KdDebuggerEnabled' : [ 0x2d4, ['unsigned char']], - 'NXSupportPolicy' : [ 0x2d5, ['unsigned char']], - 'ActiveConsoleId' : [ 0x2d8, ['unsigned long']], - 'DismountCount' : [ 0x2dc, ['unsigned long']], - 'ComPlusPackage' : [ 0x2e0, ['unsigned long']], - 'LastSystemRITEventTickCount' : [ 0x2e4, ['unsigned long']], - 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], - 'SafeBootMode' : [ 0x2ec, ['unsigned char']], - 'TraceLogging' : [ 0x2f0, ['unsigned long']], - 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], - 'SystemCall' : [ 0x300, ['unsigned long']], - 'SystemCallReturn' : [ 0x304, ['unsigned long']], - 'SystemCallPad' : [ 0x308, ['array', 3, ['unsigned long long']]], - 'TickCount' : [ 0x320, ['_KSYSTEM_TIME']], - 'TickCountQuad' : [ 0x320, ['unsigned long long']], - 'Cookie' : [ 0x330, ['unsigned long']], - 'Wow64SharedInformation' : [ 0x334, ['array', 16, ['unsigned long']]], -} ], - '__unnamed_1026' : [ 0x8, { + '__unnamed_100d' : [ 0x8, { 'LowPart' : [ 0x0, ['unsigned long']], 'HighPart' : [ 0x4, ['unsigned long']], } ], '_ULARGE_INTEGER' : [ 0x8, { 'LowPart' : [ 0x0, ['unsigned long']], 'HighPart' : [ 0x4, ['unsigned long']], - 'u' : [ 0x0, ['__unnamed_1026']], + 'u' : [ 0x0, ['__unnamed_100d']], 'QuadPart' : [ 0x0, ['unsigned long long']], -} ], - '_TEB' : [ 0xfbc, { - 'NtTib' : [ 0x0, ['_NT_TIB']], - 'EnvironmentPointer' : [ 0x1c, ['pointer', ['void']]], - 'ClientId' : [ 0x20, ['_CLIENT_ID']], - 'ActiveRpcHandle' : [ 0x28, ['pointer', ['void']]], - 'ThreadLocalStoragePointer' : [ 0x2c, ['pointer', ['void']]], - 'ProcessEnvironmentBlock' : [ 0x30, ['pointer', ['_PEB']]], - 'LastErrorValue' : [ 0x34, ['unsigned long']], - 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], - 'CsrClientThread' : [ 0x3c, ['pointer', ['void']]], - 'Win32ThreadInfo' : [ 0x40, ['pointer', ['void']]], - 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], - 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], - 'WOW32Reserved' : [ 0xc0, ['pointer', ['void']]], - 'CurrentLocale' : [ 0xc4, ['unsigned long']], - 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], - 'SystemReserved1' : [ 0xcc, ['array', 54, ['pointer', ['void']]]], - 'ExceptionCode' : [ 0x1a4, ['long']], - 'ActivationContextStackPointer' : [ 0x1a8, ['pointer', ['_ACTIVATION_CONTEXT_STACK']]], - 'SpareBytes1' : [ 0x1ac, ['array', 40, ['unsigned char']]], - 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH']], - 'RealClientId' : [ 0x6b4, ['_CLIENT_ID']], - 'GdiCachedProcessHandle' : [ 0x6bc, ['pointer', ['void']]], - 'GdiClientPID' : [ 0x6c0, ['unsigned long']], - 'GdiClientTID' : [ 0x6c4, ['unsigned long']], - 'GdiThreadLocalInfo' : [ 0x6c8, ['pointer', ['void']]], - 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], - 'glDispatchTable' : [ 0x7c4, ['array', 233, ['pointer', ['void']]]], - 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], - 'glReserved2' : [ 0xbdc, ['pointer', ['void']]], - 'glSectionInfo' : [ 0xbe0, ['pointer', ['void']]], - 'glSection' : [ 0xbe4, ['pointer', ['void']]], - 'glTable' : [ 0xbe8, ['pointer', ['void']]], - 'glCurrentRC' : [ 0xbec, ['pointer', ['void']]], - 'glContext' : [ 0xbf0, ['pointer', ['void']]], - 'LastStatusValue' : [ 0xbf4, ['unsigned long']], - 'StaticUnicodeString' : [ 0xbf8, ['_UNICODE_STRING']], - 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], - 'DeallocationStack' : [ 0xe0c, ['pointer', ['void']]], - 'TlsSlots' : [ 0xe10, ['array', 64, ['pointer', ['void']]]], - 'TlsLinks' : [ 0xf10, ['_LIST_ENTRY']], - 'Vdm' : [ 0xf18, ['pointer', ['void']]], - 'ReservedForNtRpc' : [ 0xf1c, ['pointer', ['void']]], - 'DbgSsReserved' : [ 0xf20, ['array', 2, ['pointer', ['void']]]], - 'HardErrorMode' : [ 0xf28, ['unsigned long']], - 'Instrumentation' : [ 0xf2c, ['array', 14, ['pointer', ['void']]]], - 'SubProcessTag' : [ 0xf64, ['pointer', ['void']]], - 'EtwTraceData' : [ 0xf68, ['pointer', ['void']]], - 'WinSockData' : [ 0xf6c, ['pointer', ['void']]], - 'GdiBatchCount' : [ 0xf70, ['unsigned long']], - 'InDbgPrint' : [ 0xf74, ['unsigned char']], - 'FreeStackOnTermination' : [ 0xf75, ['unsigned char']], - 'HasFiberData' : [ 0xf76, ['unsigned char']], - 'IdealProcessor' : [ 0xf77, ['unsigned char']], - 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], - 'ReservedForPerf' : [ 0xf7c, ['pointer', ['void']]], - 'ReservedForOle' : [ 0xf80, ['pointer', ['void']]], - 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], - 'SparePointer1' : [ 0xf88, ['unsigned long']], - 'SoftPatchPtr1' : [ 0xf8c, ['unsigned long']], - 'SoftPatchPtr2' : [ 0xf90, ['unsigned long']], - 'TlsExpansionSlots' : [ 0xf94, ['pointer', ['pointer', ['void']]]], - 'ImpersonationLocale' : [ 0xf98, ['unsigned long']], - 'IsImpersonating' : [ 0xf9c, ['unsigned long']], - 'NlsCache' : [ 0xfa0, ['pointer', ['void']]], - 'pShimData' : [ 0xfa4, ['pointer', ['void']]], - 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned long']], - 'CurrentTransactionHandle' : [ 0xfac, ['pointer', ['void']]], - 'ActiveFrame' : [ 0xfb0, ['pointer', ['_TEB_ACTIVE_FRAME']]], - 'FlsData' : [ 0xfb4, ['pointer', ['void']]], - 'SafeThunkCall' : [ 0xfb8, ['unsigned char']], - 'BooleanSpare' : [ 0xfb9, ['array', 3, ['unsigned char']]], } ], '_LIST_ENTRY' : [ 0x8, { 'Flink' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], @@ -147,35 +26,14 @@ nt_types = { 'FileHeader' : [ 0x4, ['_IMAGE_FILE_HEADER']], 'OptionalHeader' : [ 0x18, ['_IMAGE_OPTIONAL_HEADER']], } ], - '_IMAGE_DOS_HEADER' : [ 0x40, { - 'e_magic' : [ 0x0, ['unsigned short']], - 'e_cblp' : [ 0x2, ['unsigned short']], - 'e_cp' : [ 0x4, ['unsigned short']], - 'e_crlc' : [ 0x6, ['unsigned short']], - 'e_cparhdr' : [ 0x8, ['unsigned short']], - 'e_minalloc' : [ 0xa, ['unsigned short']], - 'e_maxalloc' : [ 0xc, ['unsigned short']], - 'e_ss' : [ 0xe, ['unsigned short']], - 'e_sp' : [ 0x10, ['unsigned short']], - 'e_csum' : [ 0x12, ['unsigned short']], - 'e_ip' : [ 0x14, ['unsigned short']], - 'e_cs' : [ 0x16, ['unsigned short']], - 'e_lfarlc' : [ 0x18, ['unsigned short']], - 'e_ovno' : [ 0x1a, ['unsigned short']], - 'e_res' : [ 0x1c, ['array', 4, ['unsigned short']]], - 'e_oemid' : [ 0x24, ['unsigned short']], - 'e_oeminfo' : [ 0x26, ['unsigned short']], - 'e_res2' : [ 0x28, ['array', 10, ['unsigned short']]], - 'e_lfanew' : [ 0x3c, ['long']], -} ], - '__unnamed_1057' : [ 0x8, { + '__unnamed_101e' : [ 0x8, { 'LowPart' : [ 0x0, ['unsigned long']], 'HighPart' : [ 0x4, ['long']], } ], '_LARGE_INTEGER' : [ 0x8, { 'LowPart' : [ 0x0, ['unsigned long']], 'HighPart' : [ 0x4, ['long']], - 'u' : [ 0x0, ['__unnamed_1057']], + 'u' : [ 0x0, ['__unnamed_101e']], 'QuadPart' : [ 0x0, ['long long']], } ], '_LUID' : [ 0x8, { @@ -422,10 +280,10 @@ nt_types = { 'Teb' : [ 0x74, ['pointer', ['void']]], 'Timer' : [ 0x78, ['_KTIMER']], 'TimerFill' : [ 0x78, ['array', 40, ['unsigned char']]], - 'AutoAlignment' : [ 0xa0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xa0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'GuiThread' : [ 0xa0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ReservedFlags' : [ 0xa0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'AutoAlignment' : [ 0xa0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0xa0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'GuiThread' : [ 0xa0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xa0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'ThreadFlags' : [ 0xa0, ['long']], 'WaitBlock' : [ 0xa8, ['array', 4, ['_KWAIT_BLOCK']]], 'WaitBlockFill0' : [ 0xa8, ['array', 23, ['unsigned char']]], @@ -487,9 +345,6 @@ nt_types = { 'Contention' : [ 0x8, ['unsigned long']], 'Gate' : [ 0xc, ['_KEVENT']], 'OldIrql' : [ 0x1c, ['unsigned long']], -} ], - '_KEVENT' : [ 0x10, { - 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], } ], '_SLIST_HEADER' : [ 0x8, { 'Alignment' : [ 0x0, ['unsigned long long']], @@ -504,10 +359,6 @@ nt_types = { '_PAGED_LOOKASIDE_LIST' : [ 0xc0, { 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['_FAST_MUTEX']], -} ], - '_PP_LOOKASIDE_LIST' : [ 0x8, { - 'P' : [ 0x0, ['pointer', ['_GENERAL_LOOKASIDE']]], - 'L' : [ 0x4, ['pointer', ['_GENERAL_LOOKASIDE']]], } ], '_GENERAL_LOOKASIDE' : [ 0x80, { 'ListHead' : [ 0x0, ['_SLIST_HEADER']], @@ -536,15 +387,15 @@ nt_types = { } ], '_EX_FAST_REF' : [ 0x4, { 'Object' : [ 0x0, ['pointer', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], } ], '_EX_PUSH_LOCK' : [ 0x4, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -557,8 +408,8 @@ nt_types = { 'ShareCount' : [ 0x1c, ['long']], 'Flags' : [ 0x20, ['long']], } ], - '_EX_PUSH_LOCK_CACHE_AWARE' : [ 0x4, { - 'Locks' : [ 0x0, ['array', 1, ['pointer', ['_EX_PUSH_LOCK']]]], + '_EX_PUSH_LOCK_CACHE_AWARE' : [ 0x80, { + 'Locks' : [ 0x0, ['array', 32, ['pointer', ['_EX_PUSH_LOCK']]]], } ], '_ETHREAD' : [ 0x250, { 'Tcb' : [ 0x0, ['_KTHREAD']], @@ -594,31 +445,31 @@ nt_types = { 'ReadClusterSize' : [ 0x238, ['unsigned long']], 'GrantedAccess' : [ 0x23c, ['unsigned long']], 'CrossThreadFlags' : [ 0x240, ['unsigned long']], - 'Terminated' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeadThread' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x240, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x240, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x240, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x240, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x240, ['BitField', dict(start_bit = 8, end_bit = 9)]], + 'Terminated' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeadThread' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x240, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x240, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x240, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x240, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x240, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x244, ['unsigned long']], - 'ActiveExWorker' : [ 0x244, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x244, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x244, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'KeyedEventInUse' : [ 0x244, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'ActiveExWorker' : [ 0x244, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x244, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x244, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x244, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x248, ['unsigned long']], - 'LpcReceivedMsgIdValid' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LpcExitThreadCalled' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'AddressSpaceOwner' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemWorkingSetExclusive' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemWorkingSetShared' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x249, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ApcNeeded' : [ 0x249, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'LpcReceivedMsgIdValid' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'LpcExitThreadCalled' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'AddressSpaceOwner' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemWorkingSetExclusive' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemWorkingSetShared' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x249, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ApcNeeded' : [ 0x249, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], 'ForwardClusterOnly' : [ 0x24c, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x24d, ['unsigned char']], 'ActiveFaultCount' : [ 0x24e, ['unsigned char']], @@ -693,35 +544,35 @@ nt_types = { 'ModifiedPageCount' : [ 0x238, ['unsigned long']], 'JobStatus' : [ 0x23c, ['unsigned long']], 'Flags' : [ 0x240, ['unsigned long']], - 'CreateReported' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x240, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x240, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x240, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x240, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x240, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x240, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x240, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x240, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x240, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'SessionCreationUnderway' : [ 0x240, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x240, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x240, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x240, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x240, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x240, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x240, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x240, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x240, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x240, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x240, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'SmapAllowed' : [ 0x240, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'CreateFailed' : [ 0x240, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x240, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'Spare1' : [ 0x240, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'Spare2' : [ 0x240, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x240, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x240, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x240, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x240, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x240, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x240, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x240, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x240, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x240, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x240, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'SessionCreationUnderway' : [ 0x240, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x240, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x240, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x240, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x240, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x240, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x240, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x240, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x240, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x240, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x240, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'SmapAllowed' : [ 0x240, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'CreateFailed' : [ 0x240, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x240, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'Spare1' : [ 0x240, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Spare2' : [ 0x240, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x244, ['long']], 'NextPageColor' : [ 0x248, ['unsigned short']], 'SubSystemMinorVersion' : [ 0x24a, ['unsigned char']], @@ -730,41 +581,6 @@ nt_types = { 'PriorityClass' : [ 0x24c, ['unsigned char']], 'VadRoot' : [ 0x250, ['_MM_AVL_TABLE']], 'Cookie' : [ 0x270, ['unsigned long']], -} ], - '_KPROCESS' : [ 0x78, { - 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], - 'ProfileListHead' : [ 0x10, ['_LIST_ENTRY']], - 'DirectoryTableBase' : [ 0x18, ['array', 2, ['unsigned long']]], - 'LdtDescriptor' : [ 0x20, ['_KGDTENTRY']], - 'Int21Descriptor' : [ 0x28, ['_KIDTENTRY']], - 'IopmOffset' : [ 0x30, ['unsigned short']], - 'Iopl' : [ 0x32, ['unsigned char']], - 'Unused' : [ 0x33, ['unsigned char']], - 'ActiveProcessors' : [ 0x34, ['unsigned long']], - 'KernelTime' : [ 0x38, ['unsigned long']], - 'UserTime' : [ 0x3c, ['unsigned long']], - 'ReadyListHead' : [ 0x40, ['_LIST_ENTRY']], - 'SwapListEntry' : [ 0x48, ['_SINGLE_LIST_ENTRY']], - 'VdmTrapcHandler' : [ 0x4c, ['pointer', ['void']]], - 'ThreadListHead' : [ 0x50, ['_LIST_ENTRY']], - 'ProcessLock' : [ 0x58, ['unsigned long']], - 'Affinity' : [ 0x5c, ['unsigned long']], - 'AutoAlignment' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x60, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0x60, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ReservedFlags' : [ 0x60, ['BitField', dict(start_bit = 3, end_bit = 32)]], - 'ProcessFlags' : [ 0x60, ['long']], - 'BasePriority' : [ 0x64, ['unsigned char']], - 'QuantumReset' : [ 0x65, ['unsigned char']], - 'State' : [ 0x66, ['unsigned char']], - 'ThreadSeed' : [ 0x67, ['unsigned char']], - 'PowerState' : [ 0x68, ['unsigned char']], - 'IdealNode' : [ 0x69, ['unsigned char']], - 'Visited' : [ 0x6a, ['unsigned char']], - 'Flags' : [ 0x6b, ['_KEXECUTE_OPTIONS']], - 'ExecuteOptions' : [ 0x6b, ['unsigned char']], - 'StackCount' : [ 0x6c, ['unsigned long']], - 'ProcessListEntry' : [ 0x70, ['_LIST_ENTRY']], } ], '_OBJECT_HEADER' : [ 0x20, { 'PointerCount' : [ 0x0, ['long']], @@ -839,10 +655,7 @@ nt_types = { 'SpecialApcDisable' : [ 0x1e, ['short']], 'CombinedApcDisable' : [ 0x1c, ['unsigned long']], } ], - '_KGATE' : [ 0x10, { - 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], -} ], - '__unnamed_1209' : [ 0x4, { + '__unnamed_1152' : [ 0x4, { 'Long' : [ 0x0, ['unsigned long']], 'Flush' : [ 0x0, ['_HARDWARE_PTE']], 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], @@ -853,131 +666,95 @@ nt_types = { 'List' : [ 0x0, ['_MMPTE_LIST']], } ], '_MMPTE' : [ 0x4, { - 'u' : [ 0x0, ['__unnamed_1209']], + 'u' : [ 0x0, ['__unnamed_1152']], } ], - '__unnamed_1215' : [ 0x4, { + '__unnamed_115f' : [ 0x4, { 'Flink' : [ 0x0, ['unsigned long']], 'WsIndex' : [ 0x0, ['unsigned long']], 'Event' : [ 0x0, ['pointer', ['_KEVENT']]], 'ReadStatus' : [ 0x0, ['long']], 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], } ], - '__unnamed_1217' : [ 0x4, { + '__unnamed_1161' : [ 0x4, { 'Blink' : [ 0x0, ['unsigned long']], 'ShareCount' : [ 0x0, ['unsigned long']], } ], - '__unnamed_121a' : [ 0x4, { + '__unnamed_1164' : [ 0x4, { 'ReferenceCount' : [ 0x0, ['unsigned short']], 'ShortFlags' : [ 0x2, ['unsigned short']], } ], - '__unnamed_121c' : [ 0x4, { + '__unnamed_1166' : [ 0x4, { 'ReferenceCount' : [ 0x0, ['unsigned short']], 'e1' : [ 0x2, ['_MMPFNENTRY']], - 'e2' : [ 0x0, ['__unnamed_121a']], + 'e2' : [ 0x0, ['__unnamed_1164']], } ], - '__unnamed_1221' : [ 0x4, { + '__unnamed_116b' : [ 0x4, { 'EntireFrame' : [ 0x0, ['unsigned long']], - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25)]], - 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'Priority' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 31)]], - 'MustBeCached' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 31, native_type='unsigned long')]], + 'MustBeCached' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_MMPFN' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_1215']], + 'u1' : [ 0x0, ['__unnamed_115f']], 'PteAddress' : [ 0x4, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x8, ['__unnamed_1217']], - 'u3' : [ 0xc, ['__unnamed_121c']], + 'u2' : [ 0x8, ['__unnamed_1161']], + 'u3' : [ 0xc, ['__unnamed_1166']], 'OriginalPte' : [ 0x10, ['_MMPTE']], 'AweReferenceCount' : [ 0x10, ['long']], - 'u4' : [ 0x14, ['__unnamed_1221']], + 'u4' : [ 0x14, ['__unnamed_116b']], } ], - '_MM_AVL_TABLE' : [ 0x20, { - 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32)]], - 'NodeHint' : [ 0x18, ['pointer', ['void']]], - 'NodeFreeHint' : [ 0x1c, ['pointer', ['void']]], -} ], - '__unnamed_123c' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + '__unnamed_1172' : [ 0x4, { + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMVAD']]], } ], - '__unnamed_123f' : [ 0x4, { + '__unnamed_1175' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], } ], - '__unnamed_1244' : [ 0x4, { + '__unnamed_117a' : [ 0x4, { 'LongFlags2' : [ 0x0, ['unsigned long']], 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], } ], '_MMVAD' : [ 0x28, { - 'u1' : [ 0x0, ['__unnamed_123c']], + 'u1' : [ 0x0, ['__unnamed_1172']], 'LeftChild' : [ 0x4, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x8, ['pointer', ['_MMVAD']]], 'StartingVpn' : [ 0xc, ['unsigned long']], 'EndingVpn' : [ 0x10, ['unsigned long']], - 'u' : [ 0x14, ['__unnamed_123f']], + 'u' : [ 0x14, ['__unnamed_1175']], 'ControlArea' : [ 0x18, ['pointer', ['_CONTROL_AREA']]], 'FirstPrototypePte' : [ 0x1c, ['pointer', ['_MMPTE']]], 'LastContiguousPte' : [ 0x20, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x24, ['__unnamed_1244']], + 'u2' : [ 0x24, ['__unnamed_117a']], } ], - '__unnamed_124c' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'Parent' : [ 0x0, ['pointer', ['_MMADDRESS_NODE']]], -} ], - '_MMADDRESS_NODE' : [ 0x14, { - 'u1' : [ 0x0, ['__unnamed_124c']], - 'LeftChild' : [ 0x4, ['pointer', ['_MMADDRESS_NODE']]], - 'RightChild' : [ 0x8, ['pointer', ['_MMADDRESS_NODE']]], - 'StartingVpn' : [ 0xc, ['unsigned long']], - 'EndingVpn' : [ 0x10, ['unsigned long']], + '_MM_AVL_TABLE' : [ 0x20, { + 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], + 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], + 'NodeHint' : [ 0x18, ['pointer', ['void']]], + 'NodeFreeHint' : [ 0x1c, ['pointer', ['void']]], } ], '_MMPTE_FLUSH_LIST' : [ 0x88, { 'Count' : [ 0x0, ['unsigned long']], 'FlushVa' : [ 0x4, ['array', 33, ['pointer', ['void']]]], } ], - '_MMCOLOR_TABLES' : [ 0xc, { - 'Flink' : [ 0x0, ['unsigned long']], - 'Blink' : [ 0x4, ['pointer', ['void']]], - 'Count' : [ 0x8, ['unsigned long']], -} ], - '__unnamed_1267' : [ 0x4, { + '__unnamed_118c' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], } ], '_SUBSECTION' : [ 0x20, { 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], - 'u' : [ 0x4, ['__unnamed_1267']], + 'u' : [ 0x4, ['__unnamed_118c']], 'StartingSector' : [ 0x8, ['unsigned long']], 'NumberOfFullSectors' : [ 0xc, ['unsigned long']], 'SubsectionBase' : [ 0x10, ['pointer', ['_MMPTE']]], 'UnusedPtes' : [ 0x14, ['unsigned long']], 'PtesInSubsection' : [ 0x18, ['unsigned long']], 'NextSubsection' : [ 0x1c, ['pointer', ['_SUBSECTION']]], -} ], - '__unnamed_126f' : [ 0x4, { - 'LongFlags' : [ 0x0, ['unsigned long']], - 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], -} ], - '_CONTROL_AREA' : [ 0x38, { - 'Segment' : [ 0x0, ['pointer', ['_SEGMENT']]], - 'DereferenceList' : [ 0x4, ['_LIST_ENTRY']], - 'NumberOfSectionReferences' : [ 0xc, ['unsigned long']], - 'NumberOfPfnReferences' : [ 0x10, ['unsigned long']], - 'NumberOfMappedViews' : [ 0x14, ['unsigned long']], - 'NumberOfSystemCacheViews' : [ 0x18, ['unsigned long']], - 'NumberOfUserReferences' : [ 0x1c, ['unsigned long']], - 'u' : [ 0x20, ['__unnamed_126f']], - 'FilePointer' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], - 'WaitingForDeletion' : [ 0x28, ['pointer', ['_EVENT_COUNTER']]], - 'ModifiedWriteCount' : [ 0x2c, ['unsigned short']], - 'FlushInProgressCount' : [ 0x2e, ['unsigned short']], - 'WritableUserReferences' : [ 0x30, ['unsigned long']], - 'QuadwordPad' : [ 0x34, ['unsigned long']], } ], '_MMPAGING_FILE' : [ 0x3c, { 'Size' : [ 0x0, ['unsigned long']], @@ -991,163 +768,11 @@ nt_types = { 'Entry' : [ 0x20, ['array', 2, ['pointer', ['_MMMOD_WRITER_MDL_ENTRY']]]], 'PageFileName' : [ 0x28, ['_UNICODE_STRING']], 'Bitmap' : [ 0x30, ['pointer', ['_RTL_BITMAP']]], - 'PageFileNumber' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'ReferenceCount' : [ 0x34, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'BootPartition' : [ 0x34, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Reserved' : [ 0x34, ['BitField', dict(start_bit = 9, end_bit = 32)]], + 'PageFileNumber' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'ReferenceCount' : [ 0x34, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'BootPartition' : [ 0x34, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Reserved' : [ 0x34, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], 'FileHandle' : [ 0x38, ['pointer', ['void']]], -} ], - '_RTL_BITMAP' : [ 0x8, { - 'SizeOfBitMap' : [ 0x0, ['unsigned long']], - 'Buffer' : [ 0x4, ['pointer', ['unsigned long']]], -} ], - '_TEB32' : [ 0xfbc, { - 'NtTib' : [ 0x0, ['_NT_TIB32']], - 'EnvironmentPointer' : [ 0x1c, ['unsigned long']], - 'ClientId' : [ 0x20, ['_CLIENT_ID32']], - 'ActiveRpcHandle' : [ 0x28, ['unsigned long']], - 'ThreadLocalStoragePointer' : [ 0x2c, ['unsigned long']], - 'ProcessEnvironmentBlock' : [ 0x30, ['unsigned long']], - 'LastErrorValue' : [ 0x34, ['unsigned long']], - 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], - 'CsrClientThread' : [ 0x3c, ['unsigned long']], - 'Win32ThreadInfo' : [ 0x40, ['unsigned long']], - 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], - 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], - 'WOW32Reserved' : [ 0xc0, ['unsigned long']], - 'CurrentLocale' : [ 0xc4, ['unsigned long']], - 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], - 'SystemReserved1' : [ 0xcc, ['array', 54, ['unsigned long']]], - 'ExceptionCode' : [ 0x1a4, ['long']], - 'ActivationContextStackPointer' : [ 0x1a8, ['unsigned long']], - 'SpareBytes1' : [ 0x1ac, ['array', 40, ['unsigned char']]], - 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH32']], - 'RealClientId' : [ 0x6b4, ['_CLIENT_ID32']], - 'GdiCachedProcessHandle' : [ 0x6bc, ['unsigned long']], - 'GdiClientPID' : [ 0x6c0, ['unsigned long']], - 'GdiClientTID' : [ 0x6c4, ['unsigned long']], - 'GdiThreadLocalInfo' : [ 0x6c8, ['unsigned long']], - 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], - 'glDispatchTable' : [ 0x7c4, ['array', 233, ['unsigned long']]], - 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], - 'glReserved2' : [ 0xbdc, ['unsigned long']], - 'glSectionInfo' : [ 0xbe0, ['unsigned long']], - 'glSection' : [ 0xbe4, ['unsigned long']], - 'glTable' : [ 0xbe8, ['unsigned long']], - 'glCurrentRC' : [ 0xbec, ['unsigned long']], - 'glContext' : [ 0xbf0, ['unsigned long']], - 'LastStatusValue' : [ 0xbf4, ['unsigned long']], - 'StaticUnicodeString' : [ 0xbf8, ['_STRING32']], - 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['wchar']]], - 'DeallocationStack' : [ 0xe0c, ['unsigned long']], - 'TlsSlots' : [ 0xe10, ['array', 64, ['unsigned long']]], - 'TlsLinks' : [ 0xf10, ['LIST_ENTRY32']], - 'Vdm' : [ 0xf18, ['unsigned long']], - 'ReservedForNtRpc' : [ 0xf1c, ['unsigned long']], - 'DbgSsReserved' : [ 0xf20, ['array', 2, ['unsigned long']]], - 'HardErrorMode' : [ 0xf28, ['unsigned long']], - 'Instrumentation' : [ 0xf2c, ['array', 14, ['unsigned long']]], - 'SubProcessTag' : [ 0xf64, ['unsigned long']], - 'EtwTraceData' : [ 0xf68, ['unsigned long']], - 'WinSockData' : [ 0xf6c, ['unsigned long']], - 'GdiBatchCount' : [ 0xf70, ['unsigned long']], - 'InDbgPrint' : [ 0xf74, ['unsigned char']], - 'FreeStackOnTermination' : [ 0xf75, ['unsigned char']], - 'HasFiberData' : [ 0xf76, ['unsigned char']], - 'IdealProcessor' : [ 0xf77, ['unsigned char']], - 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], - 'ReservedForPerf' : [ 0xf7c, ['unsigned long']], - 'ReservedForOle' : [ 0xf80, ['unsigned long']], - 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], - 'SparePointer1' : [ 0xf88, ['unsigned long']], - 'SoftPatchPtr1' : [ 0xf8c, ['unsigned long']], - 'SoftPatchPtr2' : [ 0xf90, ['unsigned long']], - 'TlsExpansionSlots' : [ 0xf94, ['unsigned long']], - 'ImpersonationLocale' : [ 0xf98, ['unsigned long']], - 'IsImpersonating' : [ 0xf9c, ['unsigned long']], - 'NlsCache' : [ 0xfa0, ['unsigned long']], - 'pShimData' : [ 0xfa4, ['unsigned long']], - 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned long']], - 'CurrentTransactionHandle' : [ 0xfac, ['unsigned long']], - 'ActiveFrame' : [ 0xfb0, ['unsigned long']], - 'FlsData' : [ 0xfb4, ['unsigned long']], - 'SafeThunkCall' : [ 0xfb8, ['unsigned char']], - 'BooleanSpare' : [ 0xfb9, ['array', 3, ['unsigned char']]], -} ], - '_TEB64' : [ 0x17d8, { - 'NtTib' : [ 0x0, ['_NT_TIB64']], - 'EnvironmentPointer' : [ 0x38, ['unsigned long long']], - 'ClientId' : [ 0x40, ['_CLIENT_ID64']], - 'ActiveRpcHandle' : [ 0x50, ['unsigned long long']], - 'ThreadLocalStoragePointer' : [ 0x58, ['unsigned long long']], - 'ProcessEnvironmentBlock' : [ 0x60, ['unsigned long long']], - 'LastErrorValue' : [ 0x68, ['unsigned long']], - 'CountOfOwnedCriticalSections' : [ 0x6c, ['unsigned long']], - 'CsrClientThread' : [ 0x70, ['unsigned long long']], - 'Win32ThreadInfo' : [ 0x78, ['unsigned long long']], - 'User32Reserved' : [ 0x80, ['array', 26, ['unsigned long']]], - 'UserReserved' : [ 0xe8, ['array', 5, ['unsigned long']]], - 'WOW32Reserved' : [ 0x100, ['unsigned long long']], - 'CurrentLocale' : [ 0x108, ['unsigned long']], - 'FpSoftwareStatusRegister' : [ 0x10c, ['unsigned long']], - 'SystemReserved1' : [ 0x110, ['array', 54, ['unsigned long long']]], - 'ExceptionCode' : [ 0x2c0, ['long']], - 'ActivationContextStackPointer' : [ 0x2c8, ['unsigned long long']], - 'SpareBytes1' : [ 0x2d0, ['array', 28, ['unsigned char']]], - 'GdiTebBatch' : [ 0x2f0, ['_GDI_TEB_BATCH64']], - 'RealClientId' : [ 0x7d8, ['_CLIENT_ID64']], - 'GdiCachedProcessHandle' : [ 0x7e8, ['unsigned long long']], - 'GdiClientPID' : [ 0x7f0, ['unsigned long']], - 'GdiClientTID' : [ 0x7f4, ['unsigned long']], - 'GdiThreadLocalInfo' : [ 0x7f8, ['unsigned long long']], - 'Win32ClientInfo' : [ 0x800, ['array', 62, ['unsigned long long']]], - 'glDispatchTable' : [ 0x9f0, ['array', 233, ['unsigned long long']]], - 'glReserved1' : [ 0x1138, ['array', 29, ['unsigned long long']]], - 'glReserved2' : [ 0x1220, ['unsigned long long']], - 'glSectionInfo' : [ 0x1228, ['unsigned long long']], - 'glSection' : [ 0x1230, ['unsigned long long']], - 'glTable' : [ 0x1238, ['unsigned long long']], - 'glCurrentRC' : [ 0x1240, ['unsigned long long']], - 'glContext' : [ 0x1248, ['unsigned long long']], - 'LastStatusValue' : [ 0x1250, ['unsigned long']], - 'StaticUnicodeString' : [ 0x1258, ['_STRING64']], - 'StaticUnicodeBuffer' : [ 0x1268, ['array', 261, ['wchar']]], - 'DeallocationStack' : [ 0x1478, ['unsigned long long']], - 'TlsSlots' : [ 0x1480, ['array', 64, ['unsigned long long']]], - 'TlsLinks' : [ 0x1680, ['LIST_ENTRY64']], - 'Vdm' : [ 0x1690, ['unsigned long long']], - 'ReservedForNtRpc' : [ 0x1698, ['unsigned long long']], - 'DbgSsReserved' : [ 0x16a0, ['array', 2, ['unsigned long long']]], - 'HardErrorMode' : [ 0x16b0, ['unsigned long']], - 'Instrumentation' : [ 0x16b8, ['array', 14, ['unsigned long long']]], - 'SubProcessTag' : [ 0x1728, ['unsigned long long']], - 'EtwTraceData' : [ 0x1730, ['unsigned long long']], - 'WinSockData' : [ 0x1738, ['unsigned long long']], - 'GdiBatchCount' : [ 0x1740, ['unsigned long']], - 'InDbgPrint' : [ 0x1744, ['unsigned char']], - 'FreeStackOnTermination' : [ 0x1745, ['unsigned char']], - 'HasFiberData' : [ 0x1746, ['unsigned char']], - 'IdealProcessor' : [ 0x1747, ['unsigned char']], - 'GuaranteedStackBytes' : [ 0x1748, ['unsigned long']], - 'ReservedForPerf' : [ 0x1750, ['unsigned long long']], - 'ReservedForOle' : [ 0x1758, ['unsigned long long']], - 'WaitingOnLoaderLock' : [ 0x1760, ['unsigned long']], - 'SparePointer1' : [ 0x1768, ['unsigned long long']], - 'SoftPatchPtr1' : [ 0x1770, ['unsigned long long']], - 'SoftPatchPtr2' : [ 0x1778, ['unsigned long long']], - 'TlsExpansionSlots' : [ 0x1780, ['unsigned long long']], - 'DeallocationBStore' : [ 0x1788, ['unsigned long long']], - 'BStoreLimit' : [ 0x1790, ['unsigned long long']], - 'ImpersonationLocale' : [ 0x1798, ['unsigned long']], - 'IsImpersonating' : [ 0x179c, ['unsigned long']], - 'NlsCache' : [ 0x17a0, ['unsigned long long']], - 'pShimData' : [ 0x17a8, ['unsigned long long']], - 'HeapVirtualAffinity' : [ 0x17b0, ['unsigned long']], - 'CurrentTransactionHandle' : [ 0x17b8, ['unsigned long long']], - 'ActiveFrame' : [ 0x17c0, ['unsigned long long']], - 'FlsData' : [ 0x17c8, ['unsigned long long']], - 'SafeThunkCall' : [ 0x17d0, ['unsigned char']], - 'BooleanSpare' : [ 0x17d1, ['array', 3, ['unsigned char']]], } ], '_KTIMER' : [ 0x28, { 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], @@ -1155,6 +780,9 @@ nt_types = { 'TimerListEntry' : [ 0x18, ['_LIST_ENTRY']], 'Dpc' : [ 0x20, ['pointer', ['_KDPC']]], 'Period' : [ 0x24, ['long']], +} ], + '_KEVENT' : [ 0x10, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], } ], '_KLOCK_QUEUE_HANDLE' : [ 0xc, { 'LockQueue' : [ 0x0, ['_KSPIN_LOCK_QUEUE']], @@ -1184,12 +812,12 @@ nt_types = { 'Entry' : [ 0x0, ['_LIST_ENTRY']], 'Time' : [ 0x8, ['_ULARGE_INTEGER']], } ], - '__unnamed_1302' : [ 0x208, { + '__unnamed_11b9' : [ 0x208, { 'FnArea' : [ 0x0, ['_FNSAVE_FORMAT']], 'FxArea' : [ 0x0, ['_FXSAVE_FORMAT']], } ], '_FX_SAVE_AREA' : [ 0x210, { - 'U' : [ 0x0, ['__unnamed_1302']], + 'U' : [ 0x0, ['__unnamed_11b9']], 'NpxSavedCpu' : [ 0x208, ['unsigned long']], 'Cr0NpxState' : [ 0x20c, ['unsigned long']], } ], @@ -1320,7 +948,7 @@ nt_types = { 'MaxInstructions' : [ 0x14, ['unsigned long']], 'TotalInstructions' : [ 0x18, ['unsigned long']], } ], - '__unnamed_1378' : [ 0x28, { + '__unnamed_1227' : [ 0x28, { 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], @@ -1349,9 +977,9 @@ nt_types = { 'ProcessorLevel' : [ 0x4, ['unsigned short']], 'Processor' : [ 0x6, ['unsigned short']], 'ReturnStatus' : [ 0x8, ['long']], - 'u' : [ 0x10, ['__unnamed_1378']], + 'u' : [ 0x10, ['__unnamed_1227']], } ], - '__unnamed_137f' : [ 0x28, { + '__unnamed_122e' : [ 0x28, { 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], @@ -1378,43 +1006,7 @@ nt_types = { 'ProcessorLevel' : [ 0x4, ['unsigned short']], 'Processor' : [ 0x6, ['unsigned short']], 'ReturnStatus' : [ 0x8, ['long']], - 'u' : [ 0xc, ['__unnamed_137f']], -} ], - '_DBGKD_READ_WRITE_MSR' : [ 0xc, { - 'Msr' : [ 0x0, ['unsigned long']], - 'DataValueLow' : [ 0x4, ['unsigned long']], - 'DataValueHigh' : [ 0x8, ['unsigned long']], -} ], - '_DBGKD_BREAKPOINTEX' : [ 0x8, { - 'BreakPointCount' : [ 0x0, ['unsigned long']], - 'ContinueStatus' : [ 0x4, ['long']], -} ], - '_DBGKD_SEARCH_MEMORY' : [ 0x18, { - 'SearchAddress' : [ 0x0, ['unsigned long long']], - 'FoundAddress' : [ 0x0, ['unsigned long long']], - 'SearchLength' : [ 0x8, ['unsigned long long']], - 'PatternLength' : [ 0x10, ['unsigned long']], -} ], - '_DBGKD_RESTORE_BREAKPOINT' : [ 0x4, { - 'BreakPointHandle' : [ 0x0, ['unsigned long']], -} ], - '_DBGKD_CONTINUE' : [ 0x4, { - 'ContinueStatus' : [ 0x0, ['long']], -} ], - '_DBGKD_CONTINUE2' : [ 0x20, { - 'ContinueStatus' : [ 0x0, ['long']], - 'ControlSet' : [ 0x4, ['_X86_DBGKD_CONTROL_SET']], - 'AnyControlSet' : [ 0x4, ['_DBGKD_ANY_CONTROL_SET']], -} ], - '_iobuf' : [ 0x20, { - '_ptr' : [ 0x0, ['pointer', ['unsigned char']]], - '_cnt' : [ 0x4, ['long']], - '_base' : [ 0x8, ['pointer', ['unsigned char']]], - '_flag' : [ 0xc, ['long']], - '_file' : [ 0x10, ['long']], - '_charbuf' : [ 0x14, ['long']], - '_bufsiz' : [ 0x18, ['long']], - '_tmpfname' : [ 0x1c, ['pointer', ['unsigned char']]], + 'u' : [ 0xc, ['__unnamed_122e']], } ], '_SHARED_CACHE_MAP' : [ 0x138, { 'NodeTypeCode' : [ 0x0, ['short']], @@ -1489,25 +1081,25 @@ nt_types = { 'Event' : [ 0x5c, ['_KEVENT']], 'CompletionContext' : [ 0x6c, ['pointer', ['_IO_COMPLETION_CONTEXT']]], } ], - '__unnamed_143a' : [ 0x8, { + '__unnamed_1253' : [ 0x8, { 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], 'ActiveCount' : [ 0x0, ['unsigned short']], } ], '_VACB' : [ 0x18, { 'BaseAddress' : [ 0x0, ['pointer', ['void']]], 'SharedCacheMap' : [ 0x4, ['pointer', ['_SHARED_CACHE_MAP']]], - 'Overlay' : [ 0x8, ['__unnamed_143a']], + 'Overlay' : [ 0x8, ['__unnamed_1253']], 'LruList' : [ 0x10, ['_LIST_ENTRY']], } ], '_VACB_LEVEL_REFERENCE' : [ 0x8, { 'Reference' : [ 0x0, ['long']], 'SpecialReference' : [ 0x4, ['long']], } ], - '__unnamed_1456' : [ 0x10, { + '__unnamed_1268' : [ 0x10, { 'FreeListsInUseUlong' : [ 0x0, ['array', 4, ['unsigned long']]], 'FreeListsInUseBytes' : [ 0x0, ['array', 16, ['unsigned char']]], } ], - '__unnamed_1458' : [ 0x2, { + '__unnamed_126a' : [ 0x2, { 'FreeListsInUseTerminate' : [ 0x0, ['unsigned short']], 'DecommitCount' : [ 0x0, ['unsigned short']], } ], @@ -1535,8 +1127,8 @@ nt_types = { 'AlignMask' : [ 0x4c, ['unsigned long']], 'VirtualAllocdBlocks' : [ 0x50, ['_LIST_ENTRY']], 'Segments' : [ 0x58, ['array', 64, ['pointer', ['_HEAP_SEGMENT']]]], - 'u' : [ 0x158, ['__unnamed_1456']], - 'u2' : [ 0x168, ['__unnamed_1458']], + 'u' : [ 0x158, ['__unnamed_1268']], + 'u2' : [ 0x168, ['__unnamed_126a']], 'AllocatorBackTraceIndex' : [ 0x16a, ['unsigned short']], 'NonDedicatedListLength' : [ 0x16c, ['unsigned long']], 'LargeBlocksIndex' : [ 0x170, ['pointer', ['void']]], @@ -1628,11 +1220,78 @@ nt_types = { 'Flags' : [ 0x10, ['unsigned long']], 'pDeviceMap' : [ 0x14, ['pointer', ['_DEVICE_MAP']]], } ], - '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { - 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], - 'AlphaControlSet' : [ 0x0, ['unsigned long']], - 'IA64ControlSet' : [ 0x0, ['_IA64_DBGKD_CONTROL_SET']], - 'Amd64ControlSet' : [ 0x0, ['_AMD64_DBGKD_CONTROL_SET']], + '_TEB' : [ 0xfbc, { + 'NtTib' : [ 0x0, ['_NT_TIB']], + 'EnvironmentPointer' : [ 0x1c, ['pointer', ['void']]], + 'ClientId' : [ 0x20, ['_CLIENT_ID']], + 'ActiveRpcHandle' : [ 0x28, ['pointer', ['void']]], + 'ThreadLocalStoragePointer' : [ 0x2c, ['pointer', ['void']]], + 'ProcessEnvironmentBlock' : [ 0x30, ['pointer', ['_PEB']]], + 'LastErrorValue' : [ 0x34, ['unsigned long']], + 'CountOfOwnedCriticalSections' : [ 0x38, ['unsigned long']], + 'CsrClientThread' : [ 0x3c, ['pointer', ['void']]], + 'Win32ThreadInfo' : [ 0x40, ['pointer', ['void']]], + 'User32Reserved' : [ 0x44, ['array', 26, ['unsigned long']]], + 'UserReserved' : [ 0xac, ['array', 5, ['unsigned long']]], + 'WOW32Reserved' : [ 0xc0, ['pointer', ['void']]], + 'CurrentLocale' : [ 0xc4, ['unsigned long']], + 'FpSoftwareStatusRegister' : [ 0xc8, ['unsigned long']], + 'SystemReserved1' : [ 0xcc, ['array', 54, ['pointer', ['void']]]], + 'ExceptionCode' : [ 0x1a4, ['long']], + 'ActivationContextStackPointer' : [ 0x1a8, ['pointer', ['_ACTIVATION_CONTEXT_STACK']]], + 'SpareBytes1' : [ 0x1ac, ['array', 40, ['unsigned char']]], + 'GdiTebBatch' : [ 0x1d4, ['_GDI_TEB_BATCH']], + 'RealClientId' : [ 0x6b4, ['_CLIENT_ID']], + 'GdiCachedProcessHandle' : [ 0x6bc, ['pointer', ['void']]], + 'GdiClientPID' : [ 0x6c0, ['unsigned long']], + 'GdiClientTID' : [ 0x6c4, ['unsigned long']], + 'GdiThreadLocalInfo' : [ 0x6c8, ['pointer', ['void']]], + 'Win32ClientInfo' : [ 0x6cc, ['array', 62, ['unsigned long']]], + 'glDispatchTable' : [ 0x7c4, ['array', 233, ['pointer', ['void']]]], + 'glReserved1' : [ 0xb68, ['array', 29, ['unsigned long']]], + 'glReserved2' : [ 0xbdc, ['pointer', ['void']]], + 'glSectionInfo' : [ 0xbe0, ['pointer', ['void']]], + 'glSection' : [ 0xbe4, ['pointer', ['void']]], + 'glTable' : [ 0xbe8, ['pointer', ['void']]], + 'glCurrentRC' : [ 0xbec, ['pointer', ['void']]], + 'glContext' : [ 0xbf0, ['pointer', ['void']]], + 'LastStatusValue' : [ 0xbf4, ['unsigned long']], + 'StaticUnicodeString' : [ 0xbf8, ['_UNICODE_STRING']], + 'StaticUnicodeBuffer' : [ 0xc00, ['array', 261, ['unsigned short']]], + 'DeallocationStack' : [ 0xe0c, ['pointer', ['void']]], + 'TlsSlots' : [ 0xe10, ['array', 64, ['pointer', ['void']]]], + 'TlsLinks' : [ 0xf10, ['_LIST_ENTRY']], + 'Vdm' : [ 0xf18, ['pointer', ['void']]], + 'ReservedForNtRpc' : [ 0xf1c, ['pointer', ['void']]], + 'DbgSsReserved' : [ 0xf20, ['array', 2, ['pointer', ['void']]]], + 'HardErrorMode' : [ 0xf28, ['unsigned long']], + 'Instrumentation' : [ 0xf2c, ['array', 14, ['pointer', ['void']]]], + 'SubProcessTag' : [ 0xf64, ['pointer', ['void']]], + 'EtwTraceData' : [ 0xf68, ['pointer', ['void']]], + 'WinSockData' : [ 0xf6c, ['pointer', ['void']]], + 'GdiBatchCount' : [ 0xf70, ['unsigned long']], + 'InDbgPrint' : [ 0xf74, ['unsigned char']], + 'FreeStackOnTermination' : [ 0xf75, ['unsigned char']], + 'HasFiberData' : [ 0xf76, ['unsigned char']], + 'IdealProcessor' : [ 0xf77, ['unsigned char']], + 'GuaranteedStackBytes' : [ 0xf78, ['unsigned long']], + 'ReservedForPerf' : [ 0xf7c, ['pointer', ['void']]], + 'ReservedForOle' : [ 0xf80, ['pointer', ['void']]], + 'WaitingOnLoaderLock' : [ 0xf84, ['unsigned long']], + 'SparePointer1' : [ 0xf88, ['unsigned long']], + 'SoftPatchPtr1' : [ 0xf8c, ['unsigned long']], + 'SoftPatchPtr2' : [ 0xf90, ['unsigned long']], + 'TlsExpansionSlots' : [ 0xf94, ['pointer', ['pointer', ['void']]]], + 'ImpersonationLocale' : [ 0xf98, ['unsigned long']], + 'IsImpersonating' : [ 0xf9c, ['unsigned long']], + 'NlsCache' : [ 0xfa0, ['pointer', ['void']]], + 'pShimData' : [ 0xfa4, ['pointer', ['void']]], + 'HeapVirtualAffinity' : [ 0xfa8, ['unsigned long']], + 'CurrentTransactionHandle' : [ 0xfac, ['pointer', ['void']]], + 'ActiveFrame' : [ 0xfb0, ['pointer', ['_TEB_ACTIVE_FRAME']]], + 'FlsData' : [ 0xfb4, ['pointer', ['void']]], + 'SafeThunkCall' : [ 0xfb8, ['unsigned char']], + 'BooleanSpare' : [ 0xfb9, ['array', 3, ['unsigned char']]], } ], '_HEAP_UCR_SEGMENT' : [ 0x10, { 'Next' : [ 0x0, ['pointer', ['_HEAP_UCR_SEGMENT']]], @@ -1759,6 +1418,12 @@ nt_types = { 'CriticalTripPoint' : [ 0x1c, ['unsigned long']], 'ActiveTripPointCount' : [ 0x20, ['unsigned char']], 'ActiveTripPoint' : [ 0x24, ['array', 10, ['unsigned long']]], +} ], + '_DBGKD_SEARCH_MEMORY' : [ 0x18, { + 'SearchAddress' : [ 0x0, ['unsigned long long']], + 'FoundAddress' : [ 0x0, ['unsigned long long']], + 'SearchLength' : [ 0x8, ['unsigned long long']], + 'PatternLength' : [ 0x10, ['unsigned long']], } ], '_SECTION_OBJECT' : [ 0x18, { 'StartingVa' : [ 0x0, ['pointer', ['void']]], @@ -1852,6 +1517,26 @@ nt_types = { 'LargeControlArea' : [ 0x20, ['pointer', ['_LARGE_CONTROL_AREA']]], 'MmSectionFlags' : [ 0x24, ['pointer', ['_MMSECTION_FLAGS']]], 'MmSubSectionFlags' : [ 0x28, ['pointer', ['_MMSUBSECTION_FLAGS']]], +} ], + '__unnamed_1388' : [ 0x4, { + 'LongFlags' : [ 0x0, ['unsigned long']], + 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], +} ], + '_CONTROL_AREA' : [ 0x38, { + 'Segment' : [ 0x0, ['pointer', ['_SEGMENT']]], + 'DereferenceList' : [ 0x4, ['_LIST_ENTRY']], + 'NumberOfSectionReferences' : [ 0xc, ['unsigned long']], + 'NumberOfPfnReferences' : [ 0x10, ['unsigned long']], + 'NumberOfMappedViews' : [ 0x14, ['unsigned long']], + 'NumberOfSystemCacheViews' : [ 0x18, ['unsigned long']], + 'NumberOfUserReferences' : [ 0x1c, ['unsigned long']], + 'u' : [ 0x20, ['__unnamed_1388']], + 'FilePointer' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], + 'WaitingForDeletion' : [ 0x28, ['pointer', ['_EVENT_COUNTER']]], + 'ModifiedWriteCount' : [ 0x2c, ['unsigned short']], + 'FlushInProgressCount' : [ 0x2e, ['unsigned short']], + 'WritableUserReferences' : [ 0x30, ['unsigned long']], + 'QuadwordPad' : [ 0x34, ['unsigned long']], } ], '_HANDLE_TABLE' : [ 0x44, { 'TableCode' : [ 0x0, ['unsigned long']], @@ -1867,28 +1552,28 @@ nt_types = { 'NextHandleNeedingPool' : [ 0x38, ['unsigned long']], 'HandleCount' : [ 0x3c, ['long']], 'Flags' : [ 0x40, ['unsigned long']], - 'StrictFIFO' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], } ], '_POOL_HEADER' : [ 0x8, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16)]], - 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'AllocatorBackTraceIndex' : [ 0x4, ['unsigned short']], 'PoolTagHash' : [ 0x6, ['unsigned short']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_TEB_ACTIVE_FRAME' : [ 0xc, { 'Flags' : [ 0x0, ['unsigned long']], @@ -1896,12 +1581,12 @@ nt_types = { 'Context' : [ 0x8, ['pointer', ['_TEB_ACTIVE_FRAME_CONTEXT']]], } ], '_MMPTE_PROTOTYPE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_MMSUPPORT' : [ 0x48, { 'WorkingSetExpansionLinks' : [ 0x0, ['_LIST_ENTRY']], @@ -1929,14 +1614,14 @@ nt_types = { 'Info' : [ 0x38, ['EX_QUEUE_WORKER_INFO']], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20)]], - 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20, native_type='unsigned long')]], + 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], } ], '_KMUTANT' : [ 0x20, { 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], @@ -1951,7 +1636,7 @@ nt_types = { 'Size' : [ 0x8, ['unsigned long']], 'TagIndex' : [ 0xc, ['unsigned short']], 'CreatorBackTraceIndex' : [ 0xe, ['unsigned short']], - 'TagName' : [ 0x10, ['array', 24, ['wchar']]], + 'TagName' : [ 0x10, ['array', 24, ['unsigned short']]], } ], '_EPROCESS_QUOTA_BLOCK' : [ 0x40, { 'QuotaEntry' : [ 0x0, ['array', 3, ['_EPROCESS_QUOTA_ENTRY']]], @@ -2034,7 +1719,7 @@ nt_types = { 'NumberOfMappedViews' : [ 0x14, ['unsigned long']], 'NumberOfSystemCacheViews' : [ 0x18, ['unsigned long']], 'NumberOfUserReferences' : [ 0x1c, ['unsigned long']], - 'u' : [ 0x20, ['__unnamed_126f']], + 'u' : [ 0x20, ['__unnamed_1388']], 'FilePointer' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], 'WaitingForDeletion' : [ 0x28, ['pointer', ['_EVENT_COUNTER']]], 'ModifiedWriteCount' : [ 0x2c, ['unsigned short']], @@ -2044,39 +1729,15 @@ nt_types = { 'StartingFrame' : [ 0x38, ['unsigned long']], 'UserGlobalList' : [ 0x3c, ['_LIST_ENTRY']], 'SessionId' : [ 0x44, ['unsigned long']], -} ], - '__unnamed_1546' : [ 0x4, { - 'BaseMid' : [ 0x0, ['unsigned char']], - 'Flags1' : [ 0x1, ['unsigned char']], - 'Flags2' : [ 0x2, ['unsigned char']], - 'BaseHi' : [ 0x3, ['unsigned char']], -} ], - '__unnamed_154d' : [ 0x4, { - 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], -} ], - '__unnamed_154f' : [ 0x4, { - 'Bytes' : [ 0x0, ['__unnamed_1546']], - 'Bits' : [ 0x0, ['__unnamed_154d']], -} ], - '_KGDTENTRY' : [ 0x8, { - 'LimitLow' : [ 0x0, ['unsigned short']], - 'BaseLow' : [ 0x2, ['unsigned short']], - 'HighWord' : [ 0x4, ['__unnamed_154f']], } ], '_GUID' : [ 0x10, { 'Data1' : [ 0x0, ['unsigned long']], 'Data2' : [ 0x4, ['unsigned short']], 'Data3' : [ 0x6, ['unsigned short']], 'Data4' : [ 0x8, ['array', 8, ['unsigned char']]], +} ], + '_KGATE' : [ 0x10, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], } ], '_PS_JOB_TOKEN_FILTER' : [ 0x24, { 'CapturedSidCount' : [ 0x0, ['unsigned long']], @@ -2126,26 +1787,21 @@ nt_types = { 'NumberOfSymbols' : [ 0xc, ['unsigned long']], 'SizeOfOptionalHeader' : [ 0x10, ['unsigned short']], 'Characteristics' : [ 0x12, ['unsigned short']], -} ], - '_STRING64' : [ 0x10, { - 'Length' : [ 0x0, ['unsigned short']], - 'MaximumLength' : [ 0x2, ['unsigned short']], - 'Buffer' : [ 0x8, ['unsigned long long']], } ], '_MMPTE_HARDWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Writable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x8, { 'Port' : [ 0x0, ['pointer', ['void']]], @@ -2167,38 +1823,38 @@ nt_types = { 'ContextFlags' : [ 0x0, ['unsigned long']], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'filler' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'filler' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_DEFERRED_WRITE' : [ 0x28, { 'NodeTypeCode' : [ 0x0, ['short']], @@ -2233,13 +1889,13 @@ nt_types = { 'Allocate' : [ 0x1a, ['unsigned char']], } ], '_MMVAD_FLAGS' : [ 0x4, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_PS_IMPERSONATION_INFORMATION' : [ 0xc, { 'Token' : [ 0x0, ['pointer', ['void']]], @@ -2247,14 +1903,14 @@ nt_types = { 'EffectiveOnly' : [ 0x5, ['unsigned char']], 'ImpersonationLevel' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], } ], - '__unnamed_15ad' : [ 0x4, { + '__unnamed_1430' : [ 0x4, { 'LegacyDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], 'PendingDeviceRelations' : [ 0x0, ['pointer', ['_DEVICE_RELATIONS']]], } ], - '__unnamed_15af' : [ 0x4, { + '__unnamed_1432' : [ 0x4, { 'NextResourceDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], } ], - '__unnamed_15b3' : [ 0x10, { + '__unnamed_1436' : [ 0x10, { 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], 'ListEntry' : [ 0x4, ['_LIST_ENTRY']], 'SerialNumber' : [ 0xc, ['pointer', ['unsigned short']]], @@ -2296,11 +1952,11 @@ nt_types = { 'QueryTranslatorMask' : [ 0xda, ['unsigned short']], 'NoArbiterMask' : [ 0xdc, ['unsigned short']], 'QueryArbiterMask' : [ 0xde, ['unsigned short']], - 'OverUsed1' : [ 0xe0, ['__unnamed_15ad']], - 'OverUsed2' : [ 0xe4, ['__unnamed_15af']], + 'OverUsed1' : [ 0xe0, ['__unnamed_1430']], + 'OverUsed2' : [ 0xe4, ['__unnamed_1432']], 'BootResources' : [ 0xe8, ['pointer', ['_CM_RESOURCE_LIST']]], 'CapabilityFlags' : [ 0xec, ['unsigned long']], - 'DockInfo' : [ 0xf0, ['__unnamed_15b3']], + 'DockInfo' : [ 0xf0, ['__unnamed_1436']], 'DisableableDepends' : [ 0x100, ['unsigned long']], 'PendedSetInterfaceState' : [ 0x104, ['_LIST_ENTRY']], 'LegacyBusListEntry' : [ 0x10c, ['_LIST_ENTRY']], @@ -2308,17 +1964,17 @@ nt_types = { 'PreviousParent' : [ 0x118, ['pointer', ['_DEVICE_NODE']]], 'DeletedChildren' : [ 0x11c, ['unsigned long']], } ], - '_STRING32' : [ 0x8, { - 'Length' : [ 0x0, ['unsigned short']], - 'MaximumLength' : [ 0x2, ['unsigned short']], - 'Buffer' : [ 0x4, ['unsigned long']], -} ], - '__unnamed_15ba' : [ 0x38, { + '__unnamed_143b' : [ 0x38, { 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], 'Resource' : [ 0x0, ['_ERESOURCE']], } ], '_HEAP_LOCK' : [ 0x38, { - 'Lock' : [ 0x0, ['__unnamed_15ba']], + 'Lock' : [ 0x0, ['__unnamed_143b']], +} ], + '_MMCOLOR_TABLES' : [ 0xc, { + 'Flink' : [ 0x0, ['unsigned long']], + 'Blink' : [ 0x4, ['pointer', ['void']]], + 'Count' : [ 0x8, ['unsigned long']], } ], '_ACL' : [ 0x8, { 'AclRevision' : [ 0x0, ['unsigned char']], @@ -2332,19 +1988,58 @@ nt_types = { 'Length' : [ 0x8, ['unsigned long']], 'Flags' : [ 0xc, ['unsigned short']], 'PatternLength' : [ 0xe, ['unsigned short']], +} ], + '_PP_LOOKASIDE_LIST' : [ 0x8, { + 'P' : [ 0x0, ['pointer', ['_GENERAL_LOOKASIDE']]], + 'L' : [ 0x4, ['pointer', ['_GENERAL_LOOKASIDE']]], +} ], + '_KPROCESS' : [ 0x78, { + 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], + 'ProfileListHead' : [ 0x10, ['_LIST_ENTRY']], + 'DirectoryTableBase' : [ 0x18, ['array', 2, ['unsigned long']]], + 'LdtDescriptor' : [ 0x20, ['_KGDTENTRY']], + 'Int21Descriptor' : [ 0x28, ['_KIDTENTRY']], + 'IopmOffset' : [ 0x30, ['unsigned short']], + 'Iopl' : [ 0x32, ['unsigned char']], + 'Unused' : [ 0x33, ['unsigned char']], + 'ActiveProcessors' : [ 0x34, ['unsigned long']], + 'KernelTime' : [ 0x38, ['unsigned long']], + 'UserTime' : [ 0x3c, ['unsigned long']], + 'ReadyListHead' : [ 0x40, ['_LIST_ENTRY']], + 'SwapListEntry' : [ 0x48, ['_SINGLE_LIST_ENTRY']], + 'VdmTrapcHandler' : [ 0x4c, ['pointer', ['void']]], + 'ThreadListHead' : [ 0x50, ['_LIST_ENTRY']], + 'ProcessLock' : [ 0x58, ['unsigned long']], + 'Affinity' : [ 0x5c, ['unsigned long']], + 'AutoAlignment' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x60, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x60, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ReservedFlags' : [ 0x60, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='long')]], + 'ProcessFlags' : [ 0x60, ['long']], + 'BasePriority' : [ 0x64, ['unsigned char']], + 'QuantumReset' : [ 0x65, ['unsigned char']], + 'State' : [ 0x66, ['unsigned char']], + 'ThreadSeed' : [ 0x67, ['unsigned char']], + 'PowerState' : [ 0x68, ['unsigned char']], + 'IdealNode' : [ 0x69, ['unsigned char']], + 'Visited' : [ 0x6a, ['unsigned char']], + 'Flags' : [ 0x6b, ['_KEXECUTE_OPTIONS']], + 'ExecuteOptions' : [ 0x6b, ['unsigned char']], + 'StackCount' : [ 0x6c, ['unsigned long']], + 'ProcessListEntry' : [ 0x70, ['_LIST_ENTRY']], } ], '_PHYSICAL_MEMORY_RUN' : [ 0x8, { 'BasePage' : [ 0x0, ['unsigned long']], 'PageCount' : [ 0x4, ['unsigned long']], } ], - '__unnamed_15c9' : [ 0x4, { + '__unnamed_1457' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], } ], '_MM_SESSION_SPACE' : [ 0x1ec0, { 'GlobalVirtualAddress' : [ 0x0, ['pointer', ['_MM_SESSION_SPACE']]], 'ReferenceCount' : [ 0x4, ['long']], - 'u' : [ 0x8, ['__unnamed_15c9']], + 'u' : [ 0x8, ['__unnamed_1457']], 'SessionId' : [ 0xc, ['unsigned long']], 'ProcessList' : [ 0x10, ['_LIST_ENTRY']], 'LastProcessSwappedOutTime' : [ 0x18, ['_LARGE_INTEGER']], @@ -2380,8 +2075,8 @@ nt_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['pointer', ['void']]], 'ImageBaseAddress' : [ 0x8, ['pointer', ['void']]], 'Ldr' : [ 0xc, ['pointer', ['_PEB_LDR_DATA']]], @@ -2467,12 +2162,12 @@ nt_types = { 'FrameName' : [ 0x4, ['pointer', ['unsigned char']]], } ], '_MMPTE_SOFTWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { 'ListSize' : [ 0x0, ['unsigned long']], @@ -2483,14 +2178,14 @@ nt_types = { 'AlternativeLists' : [ 0x1c, ['unsigned long']], 'List' : [ 0x20, ['array', 1, ['_IO_RESOURCE_LIST']]], } ], - '__unnamed_15f9' : [ 0x8, { + '__unnamed_1488' : [ 0x8, { 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], 'LastByte' : [ 0x0, ['_LARGE_INTEGER']], } ], '_MMMOD_WRITER_MDL_ENTRY' : [ 0x60, { 'Links' : [ 0x0, ['_LIST_ENTRY']], 'WriteOffset' : [ 0x8, ['_LARGE_INTEGER']], - 'u' : [ 0x10, ['__unnamed_15f9']], + 'u' : [ 0x10, ['__unnamed_1488']], 'Irp' : [ 0x18, ['pointer', ['_IRP']]], 'LastPageToWrite' : [ 0x1c, ['unsigned long']], 'PagingListHead' : [ 0x20, ['pointer', ['_MMMOD_WRITER_LISTHEAD']]], @@ -2511,16 +2206,6 @@ nt_types = { 'Length' : [ 0x0, ['unsigned long']], 'GrantMask' : [ 0x4, ['unsigned long']], 'DenyMask' : [ 0x8, ['unsigned long']], -} ], - '_NT_TIB32' : [ 0x1c, { - 'ExceptionList' : [ 0x0, ['unsigned long']], - 'StackBase' : [ 0x4, ['unsigned long']], - 'StackLimit' : [ 0x8, ['unsigned long']], - 'SubSystemTib' : [ 0xc, ['unsigned long']], - 'FiberData' : [ 0x10, ['unsigned long']], - 'Version' : [ 0x10, ['unsigned long']], - 'ArbitraryUserPointer' : [ 0x14, ['unsigned long']], - 'Self' : [ 0x18, ['unsigned long']], } ], '_CM_RESOURCE_LIST' : [ 0x24, { 'Count' : [ 0x0, ['unsigned long']], @@ -2537,13 +2222,13 @@ nt_types = { 'Peak' : [ 0x8, ['unsigned long']], 'Return' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1611' : [ 0x50, { + '__unnamed_149e' : [ 0x50, { 'CellData' : [ 0x0, ['_CELL_DATA']], 'List' : [ 0x0, ['array', 1, ['unsigned long']]], } ], '_CM_CACHED_VALUE_INDEX' : [ 0x54, { 'CellIndex' : [ 0x0, ['unsigned long']], - 'Data' : [ 0x4, ['__unnamed_1611']], + 'Data' : [ 0x4, ['__unnamed_149e']], } ], '_WMI_BUFFER_HEADER' : [ 0x48, { 'Wnode' : [ 0x0, ['_WNODE_HEADER']], @@ -2568,16 +2253,6 @@ nt_types = { 'InstanceGuid' : [ 0x38, ['_GUID']], 'LoggerContext' : [ 0x38, ['pointer', ['void']]], 'GlobalEntry' : [ 0x3c, ['_SINGLE_LIST_ENTRY']], -} ], - '_NT_TIB64' : [ 0x38, { - 'ExceptionList' : [ 0x0, ['unsigned long long']], - 'StackBase' : [ 0x8, ['unsigned long long']], - 'StackLimit' : [ 0x10, ['unsigned long long']], - 'SubSystemTib' : [ 0x18, ['unsigned long long']], - 'FiberData' : [ 0x20, ['unsigned long long']], - 'Version' : [ 0x20, ['unsigned long']], - 'ArbitraryUserPointer' : [ 0x28, ['unsigned long long']], - 'Self' : [ 0x30, ['unsigned long long']], } ], '_KSEMAPHORE' : [ 0x14, { 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], @@ -2629,18 +2304,23 @@ nt_types = { 'PerfSetThrottle' : [ 0x114, ['pointer', ['void']]], 'LastC3KernelUserTime' : [ 0x118, ['unsigned long']], 'LastPackageIdleTime' : [ 0x11c, ['unsigned long']], +} ], + '_DBGKD_READ_WRITE_MSR' : [ 0xc, { + 'Msr' : [ 0x0, ['unsigned long']], + 'DataValueLow' : [ 0x4, ['unsigned long']], + 'DataValueHigh' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11)]], - 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned short')]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11, native_type='unsigned short')]], + 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned short')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14, native_type='unsigned short')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned short')]], + 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], } ], '_IO_COUNTERS' : [ 0x30, { 'ReadOperationCount' : [ 0x0, ['unsigned long long']], @@ -2717,43 +2397,23 @@ nt_types = { 'Volume' : [ 0x44, ['_LIST_ENTRY']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Available0' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'MemoryPriority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'GrowWsleHash' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AcquiredUnsafe' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Available' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Available0' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'GrowWsleHash' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'AcquiredUnsafe' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Available' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], - 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], - 'QueueWorkerInfo' : [ 0x0, ['long']], -} ], - 'PROCESSOR_PERF_STATE' : [ 0x20, { - 'PercentFrequency' : [ 0x0, ['unsigned char']], - 'MinCapacity' : [ 0x1, ['unsigned char']], - 'Power' : [ 0x2, ['unsigned short']], - 'IncreaseLevel' : [ 0x4, ['unsigned char']], - 'DecreaseLevel' : [ 0x5, ['unsigned char']], - 'Flags' : [ 0x6, ['unsigned short']], - 'IncreaseTime' : [ 0x8, ['unsigned long']], - 'DecreaseTime' : [ 0xc, ['unsigned long']], - 'IncreaseCount' : [ 0x10, ['unsigned long']], - 'DecreaseCount' : [ 0x14, ['unsigned long']], - 'PerformanceTime' : [ 0x18, ['unsigned long long']], -} ], - 'PROCESSOR_IDLE_TIMES' : [ 0x20, { - 'StartTime' : [ 0x0, ['unsigned long long']], - 'EndTime' : [ 0x8, ['unsigned long long']], - 'IdleHandlerReserved' : [ 0x10, ['array', 4, ['unsigned long']]], + '_KSYSTEM_TIME' : [ 0xc, { + 'LowPart' : [ 0x0, ['unsigned long']], + 'High1Time' : [ 0x4, ['long']], + 'High2Time' : [ 0x8, ['long']], } ], '_TERMINATION_PORT' : [ 0x8, { 'Next' : [ 0x0, ['pointer', ['_TERMINATION_PORT']]], @@ -2820,6 +2480,11 @@ nt_types = { 'OverThrottled' : [ 0x70, ['_POP_ACTION_TRIGGER']], 'Irp' : [ 0x7c, ['pointer', ['_IRP']]], 'Info' : [ 0x80, ['_THERMAL_INFORMATION']], +} ], + '_DBGKD_CONTINUE2' : [ 0x20, { + 'ContinueStatus' : [ 0x0, ['long']], + 'ControlSet' : [ 0x4, ['_X86_DBGKD_CONTROL_SET']], + 'AnyControlSet' : [ 0x4, ['_DBGKD_ANY_CONTROL_SET']], } ], '_SECURITY_TOKEN_PROXY_DATA' : [ 0x18, { 'Length' : [ 0x0, ['unsigned long']], @@ -2832,14 +2497,35 @@ nt_types = { 'Revision' : [ 0x0, ['unsigned long']], 'DynamicThrottle' : [ 0x4, ['unsigned char']], 'Spare' : [ 0x5, ['array', 3, ['unsigned char']]], - 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'PolicyCount' : [ 0xc, ['unsigned long']], 'Policy' : [ 0x10, ['array', 3, ['_PROCESSOR_POWER_POLICY_INFO']]], } ], '_OBJECT_HANDLE_COUNT_DATABASE' : [ 0xc, { 'CountEntries' : [ 0x0, ['unsigned long']], 'HandleCountEntries' : [ 0x4, ['array', 1, ['_OBJECT_HANDLE_COUNT_ENTRY']]], +} ], + '_IMAGE_DOS_HEADER' : [ 0x40, { + 'e_magic' : [ 0x0, ['unsigned short']], + 'e_cblp' : [ 0x2, ['unsigned short']], + 'e_cp' : [ 0x4, ['unsigned short']], + 'e_crlc' : [ 0x6, ['unsigned short']], + 'e_cparhdr' : [ 0x8, ['unsigned short']], + 'e_minalloc' : [ 0xa, ['unsigned short']], + 'e_maxalloc' : [ 0xc, ['unsigned short']], + 'e_ss' : [ 0xe, ['unsigned short']], + 'e_sp' : [ 0x10, ['unsigned short']], + 'e_csum' : [ 0x12, ['unsigned short']], + 'e_ip' : [ 0x14, ['unsigned short']], + 'e_cs' : [ 0x16, ['unsigned short']], + 'e_lfarlc' : [ 0x18, ['unsigned short']], + 'e_ovno' : [ 0x1a, ['unsigned short']], + 'e_res' : [ 0x1c, ['array', 4, ['unsigned short']]], + 'e_oemid' : [ 0x24, ['unsigned short']], + 'e_oeminfo' : [ 0x26, ['unsigned short']], + 'e_res2' : [ 0x28, ['array', 10, ['unsigned short']]], + 'e_lfanew' : [ 0x3c, ['long']], } ], '_OWNER_ENTRY' : [ 0x8, { 'OwnerThread' : [ 0x0, ['unsigned long']], @@ -2869,6 +2555,43 @@ nt_types = { 'DataOffset' : [ 0x14, ['unsigned long']], 'DataSelector' : [ 0x18, ['unsigned long']], 'RegisterArea' : [ 0x1c, ['array', 80, ['unsigned char']]], +} ], + 'EX_QUEUE_WORKER_INFO' : [ 0x4, { + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], + 'QueueWorkerInfo' : [ 0x0, ['long']], +} ], + 'SYSTEM_POWER_LEVEL' : [ 0x18, { + 'Enable' : [ 0x0, ['unsigned char']], + 'Spare' : [ 0x1, ['array', 3, ['unsigned char']]], + 'BatteryLevel' : [ 0x4, ['unsigned long']], + 'PowerPolicy' : [ 0x8, ['POWER_ACTION_POLICY']], + 'MinSystemState' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], +} ], + 'POWER_ACTION_POLICY' : [ 0xc, { + 'Action' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], + 'Flags' : [ 0x4, ['unsigned long']], + 'EventCode' : [ 0x8, ['unsigned long']], +} ], + 'PROCESSOR_PERF_STATE' : [ 0x20, { + 'PercentFrequency' : [ 0x0, ['unsigned char']], + 'MinCapacity' : [ 0x1, ['unsigned char']], + 'Power' : [ 0x2, ['unsigned short']], + 'IncreaseLevel' : [ 0x4, ['unsigned char']], + 'DecreaseLevel' : [ 0x5, ['unsigned char']], + 'Flags' : [ 0x6, ['unsigned short']], + 'IncreaseTime' : [ 0x8, ['unsigned long']], + 'DecreaseTime' : [ 0xc, ['unsigned long']], + 'IncreaseCount' : [ 0x10, ['unsigned long']], + 'DecreaseCount' : [ 0x14, ['unsigned long']], + 'PerformanceTime' : [ 0x18, ['unsigned long long']], +} ], + 'PROCESSOR_IDLE_TIMES' : [ 0x20, { + 'StartTime' : [ 0x0, ['unsigned long long']], + 'EndTime' : [ 0x8, ['unsigned long long']], + 'IdleHandlerReserved' : [ 0x10, ['array', 4, ['unsigned long']]], } ], '_IMAGE_ROM_OPTIONAL_HEADER' : [ 0x38, { 'Magic' : [ 0x0, ['unsigned short']], @@ -2884,14 +2607,24 @@ nt_types = { 'GprMask' : [ 0x20, ['unsigned long']], 'CprMask' : [ 0x24, ['array', 4, ['unsigned long']]], 'GpValue' : [ 0x34, ['unsigned long']], +} ], + '_iobuf' : [ 0x20, { + '_ptr' : [ 0x0, ['pointer', ['unsigned char']]], + '_cnt' : [ 0x4, ['long']], + '_base' : [ 0x8, ['pointer', ['unsigned char']]], + '_flag' : [ 0xc, ['long']], + '_file' : [ 0x10, ['long']], + '_charbuf' : [ 0x14, ['long']], + '_bufsiz' : [ 0x18, ['long']], + '_tmpfname' : [ 0x1c, ['pointer', ['unsigned char']]], } ], '_MMPTE_LIST' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_CMHIVE' : [ 0x57c, { 'Hive' : [ 0x0, ['_HHIVE']], @@ -2989,12 +2722,12 @@ nt_types = { 'ReferenceCount' : [ 0x8, ['unsigned short']], 'Flags' : [ 0xa, ['unsigned char']], 'NameLength' : [ 0xb, ['unsigned char']], - 'Name' : [ 0xc, ['array', 1, ['wchar']]], + 'Name' : [ 0xc, ['array', 1, ['unsigned short']]], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x18, { 'Version' : [ 0x0, ['unsigned short']], @@ -3015,10 +2748,10 @@ nt_types = { 'SecurityQualityOfService' : [ 0x24, ['_SECURITY_QUALITY_OF_SERVICE']], } ], '_WMI_BUFFER_STATE' : [ 0x4, { - 'Free' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InUse' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Flush' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Free' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'InUse' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Flush' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], } ], '_MMFREE_POOL_ENTRY' : [ 0x14, { 'List' : [ 0x0, ['_LIST_ENTRY']], @@ -3026,7 +2759,7 @@ nt_types = { 'Signature' : [ 0xc, ['unsigned long']], 'Owner' : [ 0x10, ['pointer', ['_MMFREE_POOL_ENTRY']]], } ], - '__unnamed_16d9' : [ 0x28, { + '__unnamed_157f' : [ 0x28, { 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], } ], @@ -3045,7 +2778,7 @@ nt_types = { 'DeviceExtension' : [ 0x28, ['pointer', ['void']]], 'DeviceType' : [ 0x2c, ['unsigned long']], 'StackSize' : [ 0x30, ['unsigned char']], - 'Queue' : [ 0x34, ['__unnamed_16d9']], + 'Queue' : [ 0x34, ['__unnamed_157f']], 'AlignmentRequirement' : [ 0x5c, ['unsigned long']], 'DeviceQueue' : [ 0x60, ['_KDEVICE_QUEUE']], 'Dpc' : [ 0x74, ['_KDPC']], @@ -3066,6 +2799,10 @@ nt_types = { 'PolicyElements' : [ 0x0, ['_SEP_AUDIT_POLICY_CATEGORIES']], 'PolicyOverlay' : [ 0x0, ['_SEP_AUDIT_POLICY_OVERLAY']], 'Overlay' : [ 0x0, ['unsigned long long']], +} ], + '_RTL_BITMAP' : [ 0x8, { + 'SizeOfBitMap' : [ 0x0, ['unsigned long']], + 'Buffer' : [ 0x4, ['pointer', ['unsigned long']]], } ], '_MBCB' : [ 0x80, { 'NodeTypeCode' : [ 0x0, ['short']], @@ -3100,6 +2837,49 @@ nt_types = { 'DeviceListHead' : [ 0x4, ['_LIST_ENTRY']], 'Lock' : [ 0xc, ['unsigned long']], 'Busy' : [ 0x10, ['unsigned char']], +} ], + '_KUSER_SHARED_DATA' : [ 0x378, { + 'TickCountLowDeprecated' : [ 0x0, ['unsigned long']], + 'TickCountMultiplier' : [ 0x4, ['unsigned long']], + 'InterruptTime' : [ 0x8, ['_KSYSTEM_TIME']], + 'SystemTime' : [ 0x14, ['_KSYSTEM_TIME']], + 'TimeZoneBias' : [ 0x20, ['_KSYSTEM_TIME']], + 'ImageNumberLow' : [ 0x2c, ['unsigned short']], + 'ImageNumberHigh' : [ 0x2e, ['unsigned short']], + 'NtSystemRoot' : [ 0x30, ['array', 260, ['unsigned short']]], + 'MaxStackTraceDepth' : [ 0x238, ['unsigned long']], + 'CryptoExponent' : [ 0x23c, ['unsigned long']], + 'TimeZoneId' : [ 0x240, ['unsigned long']], + 'LargePageMinimum' : [ 0x244, ['unsigned long']], + 'Reserved2' : [ 0x248, ['array', 7, ['unsigned long']]], + 'NtProductType' : [ 0x264, ['Enumeration', dict(target = 'long', choices = {1: 'NtProductWinNt', 2: 'NtProductLanManNt', 3: 'NtProductServer'})]], + 'ProductTypeIsValid' : [ 0x268, ['unsigned char']], + 'NtMajorVersion' : [ 0x26c, ['unsigned long']], + 'NtMinorVersion' : [ 0x270, ['unsigned long']], + 'ProcessorFeatures' : [ 0x274, ['array', 64, ['unsigned char']]], + 'Reserved1' : [ 0x2b4, ['unsigned long']], + 'Reserved3' : [ 0x2b8, ['unsigned long']], + 'TimeSlip' : [ 0x2bc, ['unsigned long']], + 'AlternativeArchitecture' : [ 0x2c0, ['Enumeration', dict(target = 'long', choices = {0: 'StandardDesign', 1: 'NEC98x86', 2: 'EndAlternatives'})]], + 'SystemExpirationDate' : [ 0x2c8, ['_LARGE_INTEGER']], + 'SuiteMask' : [ 0x2d0, ['unsigned long']], + 'KdDebuggerEnabled' : [ 0x2d4, ['unsigned char']], + 'NXSupportPolicy' : [ 0x2d5, ['unsigned char']], + 'ActiveConsoleId' : [ 0x2d8, ['unsigned long']], + 'DismountCount' : [ 0x2dc, ['unsigned long']], + 'ComPlusPackage' : [ 0x2e0, ['unsigned long']], + 'LastSystemRITEventTickCount' : [ 0x2e4, ['unsigned long']], + 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], + 'SafeBootMode' : [ 0x2ec, ['unsigned char']], + 'TraceLogging' : [ 0x2f0, ['unsigned long']], + 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], + 'SystemCall' : [ 0x300, ['unsigned long']], + 'SystemCallReturn' : [ 0x304, ['unsigned long']], + 'SystemCallPad' : [ 0x308, ['array', 3, ['unsigned long long']]], + 'TickCount' : [ 0x320, ['_KSYSTEM_TIME']], + 'TickCountQuad' : [ 0x320, ['unsigned long long']], + 'Cookie' : [ 0x330, ['unsigned long']], + 'Wow64SharedInformation' : [ 0x334, ['array', 16, ['unsigned long']]], } ], '_OBJECT_TYPE_INITIALIZER' : [ 0x4c, { 'Length' : [ 0x0, ['unsigned short']], @@ -3124,50 +2904,50 @@ nt_types = { 'OkayToCloseProcedure' : [ 0x48, ['pointer', ['void']]], } ], '_WMI_LOGGER_MODE' : [ 0x4, { - 'SequentialFile' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CircularFile' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'AppendFile' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'RealTime' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'DelayOpenFile' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'BufferOnly' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'PrivateLogger' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'AddHeader' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'UseExisting' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'UseGlobalSequence' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'UseLocalSequence' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'Unused2' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'SequentialFile' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CircularFile' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'AppendFile' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'RealTime' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DelayOpenFile' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'BufferOnly' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'PrivateLogger' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'AddHeader' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'UseExisting' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'UseGlobalSequence' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'UseLocalSequence' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'Unused2' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], } ], - '__unnamed_1719' : [ 0x8, { + '__unnamed_15cb' : [ 0x8, { 'List' : [ 0x0, ['_LIST_ENTRY']], 'Secured' : [ 0x0, ['_MMADDRESS_LIST']], } ], - '__unnamed_171f' : [ 0x4, { + '__unnamed_15d1' : [ 0x4, { 'Banked' : [ 0x0, ['pointer', ['_MMBANKED_SECTION']]], 'ExtendedInfo' : [ 0x0, ['pointer', ['_MMEXTEND_INFO']]], } ], '_MMVAD_LONG' : [ 0x34, { - 'u1' : [ 0x0, ['__unnamed_123c']], + 'u1' : [ 0x0, ['__unnamed_1172']], 'LeftChild' : [ 0x4, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x8, ['pointer', ['_MMVAD']]], 'StartingVpn' : [ 0xc, ['unsigned long']], 'EndingVpn' : [ 0x10, ['unsigned long']], - 'u' : [ 0x14, ['__unnamed_123f']], + 'u' : [ 0x14, ['__unnamed_1175']], 'ControlArea' : [ 0x18, ['pointer', ['_CONTROL_AREA']]], 'FirstPrototypePte' : [ 0x1c, ['pointer', ['_MMPTE']]], 'LastContiguousPte' : [ 0x20, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x24, ['__unnamed_1244']], - 'u3' : [ 0x28, ['__unnamed_1719']], - 'u4' : [ 0x30, ['__unnamed_171f']], + 'u2' : [ 0x24, ['__unnamed_117a']], + 'u3' : [ 0x28, ['__unnamed_15cb']], + 'u4' : [ 0x30, ['__unnamed_15d1']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], } ], '_POOL_DESCRIPTOR' : [ 0x1030, { 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], @@ -3185,19 +2965,19 @@ nt_types = { 'ListHeads' : [ 0x30, ['array', 512, ['_LIST_ENTRY']]], } ], '_HARDWARE_PTE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_PEB_LDR_DATA' : [ 0x28, { 'Length' : [ 0x0, ['unsigned long']], @@ -3253,7 +3033,7 @@ nt_types = { 'RealDevice' : [ 0xc, ['pointer', ['_DEVICE_OBJECT']]], 'SerialNumber' : [ 0x10, ['unsigned long']], 'ReferenceCount' : [ 0x14, ['unsigned long']], - 'VolumeLabel' : [ 0x18, ['array', 32, ['wchar']]], + 'VolumeLabel' : [ 0x18, ['array', 32, ['unsigned short']]], } ], '_MMSESSION' : [ 0x40, { 'SystemSpaceViewLock' : [ 0x0, ['_KGUARDED_MUTEX']], @@ -3275,14 +3055,17 @@ nt_types = { '_KiIoAccessMap' : [ 0x2024, { 'DirectionMap' : [ 0x0, ['array', 32, ['unsigned char']]], 'IoMap' : [ 0x20, ['array', 8196, ['unsigned char']]], +} ], + '_DBGKD_RESTORE_BREAKPOINT' : [ 0x4, { + 'BreakPointHandle' : [ 0x0, ['unsigned long']], } ], '_EXCEPTION_REGISTRATION_RECORD' : [ 0x8, { 'Next' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], 'Handler' : [ 0x4, ['pointer', ['void']]], } ], '_SEP_AUDIT_POLICY_OVERLAY' : [ 0x8, { - 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36)]], - 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37)]], + 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], } ], '_POOL_TRACKER_BIG_PAGES' : [ 0x10, { 'Va' : [ 0x0, ['pointer', ['void']]], @@ -3295,12 +3078,12 @@ nt_types = { 'FaultingVa' : [ 0x4, ['pointer', ['void']]], } ], '_MMPTE_SUBSECTION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 31)]], - 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 31, native_type='unsigned long')]], + 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_VI_DEADLOCK_NODE' : [ 0x68, { 'Parent' : [ 0x0, ['pointer', ['_VI_DEADLOCK_NODE']]], @@ -3310,10 +3093,10 @@ nt_types = { 'FreeListEntry' : [ 0x14, ['_LIST_ENTRY']], 'Root' : [ 0x1c, ['pointer', ['_VI_DEADLOCK_RESOURCE']]], 'ThreadEntry' : [ 0x20, ['pointer', ['_VI_DEADLOCK_THREAD']]], - 'Active' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x24, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x24, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'StackTrace' : [ 0x28, ['array', 8, ['pointer', ['void']]]], 'ParentStackTrace' : [ 0x48, ['array', 8, ['pointer', ['void']]]], } ], @@ -3463,18 +3246,18 @@ nt_types = { 'Sacl' : [ 0xc, ['pointer', ['_ACL']]], 'Dacl' : [ 0x10, ['pointer', ['_ACL']]], } ], - '__unnamed_178c' : [ 0x8, { + '__unnamed_1640' : [ 0x8, { 'UserData' : [ 0x0, ['pointer', ['void']]], 'Owner' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_178e' : [ 0x8, { + '__unnamed_1642' : [ 0x8, { 'ListHead' : [ 0x0, ['_LIST_ENTRY']], } ], '_RTLP_RANGE_LIST_ENTRY' : [ 0x28, { 'Start' : [ 0x0, ['unsigned long long']], 'End' : [ 0x8, ['unsigned long long']], - 'Allocated' : [ 0x10, ['__unnamed_178c']], - 'Merged' : [ 0x10, ['__unnamed_178e']], + 'Allocated' : [ 0x10, ['__unnamed_1640']], + 'Merged' : [ 0x10, ['__unnamed_1642']], 'Attributes' : [ 0x18, ['unsigned char']], 'PublicFlags' : [ 0x19, ['unsigned char']], 'PrivateFlags' : [ 0x1a, ['unsigned short']], @@ -3494,11 +3277,6 @@ nt_types = { 'ReAllocTag' : [ 0xc, ['_HEAP_STOP_ON_TAG']], 'FreeAddress' : [ 0x10, ['unsigned long']], 'FreeTag' : [ 0x14, ['_HEAP_STOP_ON_TAG']], -} ], - '_IA64_DBGKD_CONTROL_SET' : [ 0x14, { - 'Continue' : [ 0x0, ['unsigned long']], - 'CurrentSymbolStart' : [ 0x4, ['unsigned long long']], - 'CurrentSymbolEnd' : [ 0xc, ['unsigned long long']], } ], '_DEVICE_RELATIONS' : [ 0x8, { 'Count' : [ 0x0, ['unsigned long']], @@ -3577,7 +3355,34 @@ nt_types = { 'V86Fs' : [ 0x84, ['unsigned long']], 'V86Gs' : [ 0x88, ['unsigned long']], } ], - '__unnamed_17ba' : [ 0x5, { + '__unnamed_1666' : [ 0x4, { + 'BaseMid' : [ 0x0, ['unsigned char']], + 'Flags1' : [ 0x1, ['unsigned char']], + 'Flags2' : [ 0x2, ['unsigned char']], + 'BaseHi' : [ 0x3, ['unsigned char']], +} ], + '__unnamed_166d' : [ 0x4, { + 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], +} ], + '__unnamed_166f' : [ 0x4, { + 'Bytes' : [ 0x0, ['__unnamed_1666']], + 'Bits' : [ 0x0, ['__unnamed_166d']], +} ], + '_KGDTENTRY' : [ 0x8, { + 'LimitLow' : [ 0x0, ['unsigned short']], + 'BaseLow' : [ 0x2, ['unsigned short']], + 'HighWord' : [ 0x4, ['__unnamed_166f']], +} ], + '__unnamed_1679' : [ 0x5, { 'Acquired' : [ 0x0, ['unsigned char']], 'CacheLineSize' : [ 0x1, ['unsigned char']], 'LatencyTimer' : [ 0x2, ['unsigned char']], @@ -3614,51 +3419,51 @@ nt_types = { 'ChildWaitWakeCount' : [ 0xa4, ['unsigned long']], 'PreservedConfig' : [ 0xa8, ['pointer', ['_PCI_COMMON_CONFIG']]], 'Lock' : [ 0xac, ['_PCI_LOCK']], - 'HotPlugParameters' : [ 0xb4, ['__unnamed_17ba']], + 'HotPlugParameters' : [ 0xb4, ['__unnamed_1679']], 'BusHackFlags' : [ 0xbc, ['unsigned long']], } ], - '__unnamed_17be' : [ 0xc, { + '__unnamed_167d' : [ 0xc, { 'Start' : [ 0x0, ['_LARGE_INTEGER']], 'Length' : [ 0x8, ['unsigned long']], } ], - '__unnamed_17c0' : [ 0xc, { + '__unnamed_167f' : [ 0xc, { 'Level' : [ 0x0, ['unsigned long']], 'Vector' : [ 0x4, ['unsigned long']], 'Affinity' : [ 0x8, ['unsigned long']], } ], - '__unnamed_17c2' : [ 0xc, { + '__unnamed_1681' : [ 0xc, { 'Channel' : [ 0x0, ['unsigned long']], 'Port' : [ 0x4, ['unsigned long']], 'Reserved1' : [ 0x8, ['unsigned long']], } ], - '__unnamed_17c4' : [ 0xc, { + '__unnamed_1683' : [ 0xc, { 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], } ], - '__unnamed_17c6' : [ 0xc, { + '__unnamed_1685' : [ 0xc, { 'Start' : [ 0x0, ['unsigned long']], 'Length' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned long']], } ], - '__unnamed_17c8' : [ 0xc, { + '__unnamed_1687' : [ 0xc, { 'DataSize' : [ 0x0, ['unsigned long']], 'Reserved1' : [ 0x4, ['unsigned long']], 'Reserved2' : [ 0x8, ['unsigned long']], } ], - '__unnamed_17ca' : [ 0xc, { - 'Generic' : [ 0x0, ['__unnamed_17be']], - 'Port' : [ 0x0, ['__unnamed_17be']], - 'Interrupt' : [ 0x0, ['__unnamed_17c0']], - 'Memory' : [ 0x0, ['__unnamed_17be']], - 'Dma' : [ 0x0, ['__unnamed_17c2']], - 'DevicePrivate' : [ 0x0, ['__unnamed_17c4']], - 'BusNumber' : [ 0x0, ['__unnamed_17c6']], - 'DeviceSpecificData' : [ 0x0, ['__unnamed_17c8']], + '__unnamed_1689' : [ 0xc, { + 'Generic' : [ 0x0, ['__unnamed_167d']], + 'Port' : [ 0x0, ['__unnamed_167d']], + 'Interrupt' : [ 0x0, ['__unnamed_167f']], + 'Memory' : [ 0x0, ['__unnamed_167d']], + 'Dma' : [ 0x0, ['__unnamed_1681']], + 'DevicePrivate' : [ 0x0, ['__unnamed_1683']], + 'BusNumber' : [ 0x0, ['__unnamed_1685']], + 'DeviceSpecificData' : [ 0x0, ['__unnamed_1687']], } ], '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x10, { 'Type' : [ 0x0, ['unsigned char']], 'ShareDisposition' : [ 0x1, ['unsigned char']], 'Flags' : [ 0x2, ['unsigned short']], - 'u' : [ 0x4, ['__unnamed_17ca']], + 'u' : [ 0x4, ['__unnamed_1689']], } ], '_SYSPTES_HEADER' : [ 0xc, { 'ListHead' : [ 0x0, ['_LIST_ENTRY']], @@ -3675,11 +3480,11 @@ nt_types = { } ], '_CM_KEY_CONTROL_BLOCK' : [ 0x68, { 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x8, ['unsigned long']], 'NextHash' : [ 0xc, ['pointer', ['_CM_KEY_HASH']]], @@ -3700,10 +3505,10 @@ nt_types = { 'KcbMaxNameLen' : [ 0x58, ['unsigned short']], 'KcbMaxValueNameLen' : [ 0x5a, ['unsigned short']], 'KcbMaxValueDataLen' : [ 0x5c, ['unsigned long']], - 'KcbUserFlags' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'KcbVirtControlFlags' : [ 0x60, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'KcbDebug' : [ 0x60, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Flags' : [ 0x60, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'KcbUserFlags' : [ 0x60, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0x60, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0x60, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0x60, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], } ], '_PCI_BUS_INTERFACE_STANDARD' : [ 0x20, { 'Size' : [ 0x0, ['unsigned short']], @@ -3734,15 +3539,15 @@ nt_types = { 'ResourcesChanged' : [ 0x35, ['unsigned char']], } ], '_SEP_AUDIT_POLICY_CATEGORIES' : [ 0x8, { - 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28)]], - 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], - 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28, native_type='unsigned long')]], + 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], + 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], } ], '_CM_KEY_HASH' : [ 0x10, { 'ConvKey' : [ 0x0, ['unsigned long']], @@ -3750,20 +3555,20 @@ nt_types = { 'KeyHive' : [ 0x8, ['pointer', ['_HHIVE']]], 'KeyCell' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1806' : [ 0x4, { + '__unnamed_16c5' : [ 0x4, { 'MasterIrp' : [ 0x0, ['pointer', ['_IRP']]], 'IrpCount' : [ 0x0, ['long']], 'SystemBuffer' : [ 0x0, ['pointer', ['void']]], } ], - '__unnamed_180c' : [ 0x8, { + '__unnamed_16cb' : [ 0x8, { 'UserApcRoutine' : [ 0x0, ['pointer', ['void']]], 'UserApcContext' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_180e' : [ 0x8, { - 'AsynchronousParameters' : [ 0x0, ['__unnamed_180c']], + '__unnamed_16cd' : [ 0x8, { + 'AsynchronousParameters' : [ 0x0, ['__unnamed_16cb']], 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], } ], - '__unnamed_1816' : [ 0x28, { + '__unnamed_16d5' : [ 0x28, { 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], 'DriverContext' : [ 0x0, ['array', 4, ['pointer', ['void']]]], 'Thread' : [ 0x10, ['pointer', ['_ETHREAD']]], @@ -3773,8 +3578,8 @@ nt_types = { 'PacketType' : [ 0x20, ['unsigned long']], 'OriginalFileObject' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], } ], - '__unnamed_1818' : [ 0x30, { - 'Overlay' : [ 0x0, ['__unnamed_1816']], + '__unnamed_16d7' : [ 0x30, { + 'Overlay' : [ 0x0, ['__unnamed_16d5']], 'Apc' : [ 0x0, ['_KAPC']], 'CompletionKey' : [ 0x0, ['pointer', ['void']]], } ], @@ -3783,7 +3588,7 @@ nt_types = { 'Size' : [ 0x2, ['unsigned short']], 'MdlAddress' : [ 0x4, ['pointer', ['_MDL']]], 'Flags' : [ 0x8, ['unsigned long']], - 'AssociatedIrp' : [ 0xc, ['__unnamed_1806']], + 'AssociatedIrp' : [ 0xc, ['__unnamed_16c5']], 'ThreadListEntry' : [ 0x10, ['_LIST_ENTRY']], 'IoStatus' : [ 0x18, ['_IO_STATUS_BLOCK']], 'RequestorMode' : [ 0x20, ['unsigned char']], @@ -3796,37 +3601,26 @@ nt_types = { 'AllocationFlags' : [ 0x27, ['unsigned char']], 'UserIosb' : [ 0x28, ['pointer', ['_IO_STATUS_BLOCK']]], 'UserEvent' : [ 0x2c, ['pointer', ['_KEVENT']]], - 'Overlay' : [ 0x30, ['__unnamed_180e']], + 'Overlay' : [ 0x30, ['__unnamed_16cd']], 'CancelRoutine' : [ 0x38, ['pointer', ['void']]], 'UserBuffer' : [ 0x3c, ['pointer', ['void']]], - 'Tail' : [ 0x40, ['__unnamed_1818']], + 'Tail' : [ 0x40, ['__unnamed_16d7']], } ], '_PCI_LOCK' : [ 0x8, { 'Atom' : [ 0x0, ['unsigned long']], 'OldIrql' : [ 0x4, ['unsigned char']], -} ], - '_AMD64_DBGKD_CONTROL_SET' : [ 0x1c, { - 'TraceFlag' : [ 0x0, ['unsigned long']], - 'Dr7' : [ 0x4, ['unsigned long long']], - 'CurrentSymbolStart' : [ 0xc, ['unsigned long long']], - 'CurrentSymbolEnd' : [ 0x14, ['unsigned long long']], } ], '_CM_KEY_SECURITY_CACHE_ENTRY' : [ 0x8, { 'Cell' : [ 0x0, ['unsigned long']], 'CachedSecurity' : [ 0x4, ['pointer', ['_CM_KEY_SECURITY_CACHE']]], } ], - '_GDI_TEB_BATCH32' : [ 0x4e0, { - 'Offset' : [ 0x0, ['unsigned long']], - 'HDC' : [ 0x4, ['unsigned long']], - 'Buffer' : [ 0x8, ['array', 310, ['unsigned long']]], -} ], - '__unnamed_1826' : [ 0x4, { + '__unnamed_16e2' : [ 0x4, { 'PhysicalAddress' : [ 0x0, ['unsigned long']], 'VirtualSize' : [ 0x0, ['unsigned long']], } ], '_IMAGE_SECTION_HEADER' : [ 0x28, { 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], - 'Misc' : [ 0x8, ['__unnamed_1826']], + 'Misc' : [ 0x8, ['__unnamed_16e2']], 'VirtualAddress' : [ 0xc, ['unsigned long']], 'SizeOfRawData' : [ 0x10, ['unsigned long']], 'PointerToRawData' : [ 0x14, ['unsigned long']], @@ -3836,14 +3630,14 @@ nt_types = { 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], 'Characteristics' : [ 0x24, ['unsigned long']], } ], - '__unnamed_182c' : [ 0x4, { + '__unnamed_16e8' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], } ], '_POP_ACTION_TRIGGER' : [ 0xc, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyInitiatePowerActionAPI', 4: 'PolicySetPowerStateAPI', 5: 'PolicyImmediateDozeS4', 6: 'PolicySystemIdle'})]], 'Flags' : [ 0x4, ['unsigned char']], 'Spare' : [ 0x5, ['array', 3, ['unsigned char']]], - 'Battery' : [ 0x8, ['__unnamed_182c']], + 'Battery' : [ 0x8, ['__unnamed_16e8']], 'Wait' : [ 0x8, ['pointer', ['_POP_TRIGGER_WAIT']]], } ], '_ETIMER' : [ 0x98, { @@ -3856,30 +3650,48 @@ nt_types = { 'ApcAssociated' : [ 0x88, ['unsigned char']], 'WakeTimer' : [ 0x89, ['unsigned char']], 'WakeTimerListEntry' : [ 0x8c, ['_LIST_ENTRY']], +} ], + '_DBGKD_BREAKPOINTEX' : [ 0x8, { + 'BreakPointCount' : [ 0x0, ['unsigned long']], + 'ContinueStatus' : [ 0x4, ['long']], } ], '_CM_CELL_REMAP_BLOCK' : [ 0x8, { 'OldCell' : [ 0x0, ['unsigned long']], 'NewCell' : [ 0x4, ['unsigned long']], } ], '_PCI_PMC' : [ 0x2, { - 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], 'Support' : [ 0x1, ['_PM_SUPPORT']], } ], - '__unnamed_183e' : [ 0x4, { + '_DBGKD_CONTINUE' : [ 0x4, { + 'ContinueStatus' : [ 0x0, ['long']], +} ], + '__unnamed_16fe' : [ 0x4, { 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], 'Long' : [ 0x0, ['unsigned long']], 'e1' : [ 0x0, ['_MMWSLENTRY']], } ], '_MMWSLE' : [ 0x4, { - 'u1' : [ 0x0, ['__unnamed_183e']], + 'u1' : [ 0x0, ['__unnamed_16fe']], } ], '_EXCEPTION_POINTERS' : [ 0x8, { 'ExceptionRecord' : [ 0x0, ['pointer', ['_EXCEPTION_RECORD']]], 'ContextRecord' : [ 0x4, ['pointer', ['_CONTEXT']]], +} ], + '__unnamed_1706' : [ 0x4, { + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], + 'Parent' : [ 0x0, ['pointer', ['_MMADDRESS_NODE']]], +} ], + '_MMADDRESS_NODE' : [ 0x14, { + 'u1' : [ 0x0, ['__unnamed_1706']], + 'LeftChild' : [ 0x4, ['pointer', ['_MMADDRESS_NODE']]], + 'RightChild' : [ 0x8, ['pointer', ['_MMADDRESS_NODE']]], + 'StartingVpn' : [ 0xc, ['unsigned long']], + 'EndingVpn' : [ 0x10, ['unsigned long']], } ], '_RTL_USER_PROCESS_PARAMETERS' : [ 0x290, { 'MaximumLength' : [ 0x0, ['unsigned long']], @@ -3931,8 +3743,8 @@ nt_types = { } ], '_VI_DEADLOCK_RESOURCE' : [ 0x80, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockQueuedSpinLock', 7: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer', ['void']]], 'ThreadOwner' : [ 0xc, ['pointer', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x10, ['_LIST_ENTRY']], @@ -3972,23 +3784,23 @@ nt_types = { 'Flink' : [ 0x8, ['unsigned long']], 'Blink' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1865' : [ 0x4, { + '__unnamed_172b' : [ 0x4, { 'Spare' : [ 0x0, ['array', 4, ['unsigned char']]], } ], - '__unnamed_1867' : [ 0x4, { + '__unnamed_172d' : [ 0x4, { 'PrimaryBus' : [ 0x0, ['unsigned char']], 'SecondaryBus' : [ 0x1, ['unsigned char']], 'SubordinateBus' : [ 0x2, ['unsigned char']], - 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], } ], 'PCI_HEADER_TYPE_DEPENDENT' : [ 0x4, { - 'type0' : [ 0x0, ['__unnamed_1865']], - 'type1' : [ 0x0, ['__unnamed_1867']], - 'type2' : [ 0x0, ['__unnamed_1867']], + 'type0' : [ 0x0, ['__unnamed_172b']], + 'type1' : [ 0x0, ['__unnamed_172d']], + 'type2' : [ 0x0, ['__unnamed_172d']], } ], '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { 'BusDataType' : [ 0x0, ['unsigned long']], @@ -4039,14 +3851,8 @@ nt_types = { 'Header' : [ 0x0, ['PCI_SECONDARY_EXTENSION']], 'Interface' : [ 0xc, ['pointer', ['_PCI_INTERFACE']]], 'BusFdoExtension' : [ 0x10, ['pointer', ['_PCI_FDO_EXTENSION']]], - 'InstanceName' : [ 0x14, ['array', 24, ['wchar']]], + 'InstanceName' : [ 0x14, ['array', 24, ['unsigned short']]], 'CommonInstance' : [ 0x44, ['_ARBITER_INSTANCE']], -} ], - '_X86_DBGKD_CONTROL_SET' : [ 0x10, { - 'TraceFlag' : [ 0x0, ['unsigned long']], - 'Dr7' : [ 0x4, ['unsigned long']], - 'CurrentSymbolStart' : [ 0x8, ['unsigned long']], - 'CurrentSymbolEnd' : [ 0xc, ['unsigned long']], } ], '_HANDLE_TRACE_DB_ENTRY' : [ 0x50, { 'ClientId' : [ 0x0, ['_CLIENT_ID']], @@ -4099,14 +3905,14 @@ nt_types = { 'Align16Byte' : [ 0x200, ['array', 8, ['unsigned char']]], } ], '_MMWSLENTRY' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_OBJECT_DIRECTORY' : [ 0xa0, { 'HashBuckets' : [ 0x0, ['array', 37, ['pointer', ['_OBJECT_DIRECTORY_ENTRY']]]], @@ -4130,10 +3936,6 @@ nt_types = { 'LastTotalAllocates' : [ 0x1c, ['unsigned long']], 'LastAllocateMisses' : [ 0x20, ['unsigned long']], 'Counters' : [ 0x24, ['array', 2, ['unsigned long']]], -} ], - '_CLIENT_ID64' : [ 0x10, { - 'UniqueProcess' : [ 0x0, ['unsigned long long']], - 'UniqueThread' : [ 0x8, ['unsigned long long']], } ], '_KDPC_DATA' : [ 0x14, { 'DpcListHead' : [ 0x0, ['_LIST_ENTRY']], @@ -4210,11 +4012,11 @@ nt_types = { 'NumberParameters' : [ 0x10, ['unsigned long']], 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], } ], - '__unnamed_18dc' : [ 0x4, { + '__unnamed_179f' : [ 0x4, { 'ImageCommitment' : [ 0x0, ['unsigned long']], 'CreatingProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], } ], - '__unnamed_18e0' : [ 0x4, { + '__unnamed_17a3' : [ 0x4, { 'ImageInformation' : [ 0x0, ['pointer', ['_SECTION_IMAGE_INFORMATION']]], 'FirstMappedVa' : [ 0x0, ['pointer', ['void']]], } ], @@ -4229,8 +4031,8 @@ nt_types = { 'ExtendInfo' : [ 0x20, ['pointer', ['_MMEXTEND_INFO']]], 'SegmentFlags' : [ 0x24, ['_SEGMENT_FLAGS']], 'BasedAddress' : [ 0x28, ['pointer', ['void']]], - 'u1' : [ 0x2c, ['__unnamed_18dc']], - 'u2' : [ 0x30, ['__unnamed_18e0']], + 'u1' : [ 0x2c, ['__unnamed_179f']], + 'u2' : [ 0x30, ['__unnamed_17a3']], 'PrototypePte' : [ 0x34, ['pointer', ['_MMPTE']]], 'ThePtes' : [ 0x38, ['array', 1, ['_MMPTE']]], } ], @@ -4380,7 +4182,7 @@ nt_types = { 'ExtensionType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1768116272: 'PciPdoExtensionType', 1768116273: 'PciFdoExtensionType', 1768116274: 'PciArb_Io', 1768116275: 'PciArb_Memory', 1768116276: 'PciArb_Interrupt', 1768116277: 'PciArb_BusNumber', 1768116278: 'PciTrans_Interrupt', 1768116279: 'PciInterface_BusHandler', 1768116280: 'PciInterface_IntRouteHandler', 1768116281: 'PciInterface_PciCb', 1768116282: 'PciInterface_LegacyDeviceDetection', 1768116283: 'PciInterface_PmeHandler', 1768116284: 'PciInterface_DevicePresent', 1768116285: 'PciInterface_NativeIde', 1768116286: 'PciInterface_Location', 1768116287: 'PciInterface_AgpTarget'})]], 'Destructor' : [ 0x8, ['pointer', ['void']]], } ], - '__unnamed_190b' : [ 0x30, { + '__unnamed_17ce' : [ 0x30, { 'type0' : [ 0x0, ['_PCI_HEADER_TYPE_0']], 'type1' : [ 0x0, ['_PCI_HEADER_TYPE_1']], 'type2' : [ 0x0, ['_PCI_HEADER_TYPE_2']], @@ -4398,12 +4200,18 @@ nt_types = { 'LatencyTimer' : [ 0xd, ['unsigned char']], 'HeaderType' : [ 0xe, ['unsigned char']], 'BIST' : [ 0xf, ['unsigned char']], - 'u' : [ 0x10, ['__unnamed_190b']], + 'u' : [ 0x10, ['__unnamed_17ce']], 'DeviceSpecific' : [ 0x40, ['array', 192, ['unsigned char']]], } ], '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { 'TagIndex' : [ 0x0, ['unsigned short']], 'FreeBackTraceIndex' : [ 0x2, ['unsigned short']], +} ], + '_X86_DBGKD_CONTROL_SET' : [ 0x10, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x8, ['unsigned long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long']], } ], '_SECTION_IMAGE_INFORMATION' : [ 0x30, { 'TransferAddress' : [ 0x0, ['pointer', ['void']]], @@ -4451,10 +4259,10 @@ nt_types = { 'Run' : [ 0x8, ['array', 1, ['_PHYSICAL_MEMORY_RUN']]], } ], '_SEGMENT_FLAGS' : [ 0x4, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_PI_BUS_EXTENSION' : [ 0x44, { 'Flags' : [ 0x0, ['unsigned long']], @@ -4474,10 +4282,6 @@ nt_types = { 'BusNumber' : [ 0x38, ['unsigned long']], 'SystemPowerState' : [ 0x3c, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], 'DevicePowerState' : [ 0x40, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], -} ], - '_CLIENT_ID32' : [ 0x8, { - 'UniqueProcess' : [ 0x0, ['unsigned long']], - 'UniqueThread' : [ 0x4, ['unsigned long']], } ], '_VI_DEADLOCK_THREAD' : [ 0x1c, { 'Thread' : [ 0x0, ['pointer', ['_KTHREAD']]], @@ -4491,11 +4295,6 @@ nt_types = { '_MMEXTEND_INFO' : [ 0x10, { 'CommittedSize' : [ 0x0, ['unsigned long long']], 'ReferenceCount' : [ 0x8, ['unsigned long']], -} ], - '_GDI_TEB_BATCH64' : [ 0x4e8, { - 'Offset' : [ 0x0, ['unsigned long']], - 'HDC' : [ 0x8, ['unsigned long long']], - 'Buffer' : [ 0x10, ['array', 310, ['unsigned long']]], } ], '_IMAGE_DEBUG_DIRECTORY' : [ 0x1c, { 'Characteristics' : [ 0x0, ['unsigned long']], @@ -4546,14 +4345,14 @@ nt_types = { 'Request' : [ 0x18, ['_PORT_MESSAGE']], } ], '_MMVAD_SHORT' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_123c']], + 'u1' : [ 0x0, ['__unnamed_1172']], 'LeftChild' : [ 0x4, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x8, ['pointer', ['_MMVAD']]], 'StartingVpn' : [ 0xc, ['unsigned long']], 'EndingVpn' : [ 0x10, ['unsigned long']], - 'u' : [ 0x14, ['__unnamed_123f']], + 'u' : [ 0x14, ['__unnamed_1175']], } ], - '__unnamed_1956' : [ 0x2c, { + '__unnamed_1816' : [ 0x2c, { 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], } ], @@ -4570,7 +4369,7 @@ nt_types = { 'SubjectSecurityContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], 'SecurityDescriptor' : [ 0x2c, ['pointer', ['void']]], 'AuxData' : [ 0x30, ['pointer', ['void']]], - 'Privileges' : [ 0x34, ['__unnamed_1956']], + 'Privileges' : [ 0x34, ['__unnamed_1816']], 'AuditPrivileges' : [ 0x60, ['unsigned char']], 'ObjectName' : [ 0x64, ['_UNICODE_STRING']], 'ObjectTypeName' : [ 0x6c, ['_UNICODE_STRING']], @@ -4586,10 +4385,10 @@ nt_types = { 'Data' : [ 0x20, ['_PLUGPLAY_EVENT_BLOCK']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], } ], '_PNP_DEVICE_EVENT_LIST' : [ 0x4c, { 'Status' : [ 0x0, ['long']], @@ -4602,15 +4401,15 @@ nt_types = { 'SpecialRegisters' : [ 0x2cc, ['_KSPECIAL_REGISTERS']], } ], '_MMPTE_TRANSITION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_STRING' : [ 0x8, { 'Length' : [ 0x0, ['unsigned short']], @@ -4618,8 +4417,8 @@ nt_types = { 'Buffer' : [ 0x4, ['pointer', ['unsigned char']]], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_CM_KEY_SECURITY_CACHE' : [ 0x2c, { 'Cell' : [ 0x0, ['unsigned long']], @@ -4636,9 +4435,9 @@ nt_types = { 'DemotePercent' : [ 0xc, ['unsigned char']], 'PromotePercent' : [ 0xd, ['unsigned char']], 'Spare' : [ 0xe, ['array', 2, ['unsigned char']]], - 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_ARBITER_INSTANCE' : [ 0x9c, { 'Signature' : [ 0x0, ['unsigned long']], @@ -4704,13 +4503,6 @@ nt_types = { 'Spare6' : [ 0x60, ['pointer', ['void']]], 'Spare7' : [ 0x64, ['pointer', ['void']]], 'Spare8' : [ 0x68, ['pointer', ['void']]], -} ], - 'SYSTEM_POWER_LEVEL' : [ 0x18, { - 'Enable' : [ 0x0, ['unsigned char']], - 'Spare' : [ 0x1, ['array', 3, ['unsigned char']]], - 'BatteryLevel' : [ 0x4, ['unsigned long']], - 'PowerPolicy' : [ 0x8, ['POWER_ACTION_POLICY']], - 'MinSystemState' : [ 0x14, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], } ], '_PCI_MN_DISPATCH_TABLE' : [ 0x8, { 'DispatchStyle' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'IRP_COMPLETE', 1: 'IRP_DOWNWARD', 2: 'IRP_UPWARD', 3: 'IRP_DISPATCH'})]], @@ -4762,7 +4554,7 @@ nt_types = { 'ConvKey' : [ 0x4, ['unsigned long']], 'NextHash' : [ 0x8, ['pointer', ['_CM_KEY_HASH']]], 'NameLength' : [ 0xc, ['unsigned short']], - 'Name' : [ 0xe, ['array', 1, ['wchar']]], + 'Name' : [ 0xe, ['array', 1, ['unsigned short']]], } ], '_CM_KEY_BODY' : [ 0x44, { 'Type' : [ 0x0, ['unsigned long']], @@ -4836,47 +4628,47 @@ nt_types = { 'ModifiedId' : [ 0x10, ['_LUID']], 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], } ], - '__unnamed_19f8' : [ 0x10, { + '__unnamed_18b6' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'FileAttributes' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'EaLength' : [ 0xc, ['unsigned long']], } ], - '__unnamed_19fc' : [ 0x10, { + '__unnamed_18ba' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'Parameters' : [ 0xc, ['pointer', ['_NAMED_PIPE_CREATE_PARAMETERS']]], } ], - '__unnamed_1a00' : [ 0x10, { + '__unnamed_18be' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'Parameters' : [ 0xc, ['pointer', ['_MAILSLOT_CREATE_PARAMETERS']]], } ], - '__unnamed_1a02' : [ 0x10, { + '__unnamed_18c0' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'Key' : [ 0x4, ['unsigned long']], 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], } ], - '__unnamed_1a06' : [ 0x10, { + '__unnamed_18c4' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'FileName' : [ 0x4, ['pointer', ['_UNICODE_STRING']]], 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileMaximumInformation'})]], 'FileIndex' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1a08' : [ 0x8, { + '__unnamed_18c6' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'CompletionFilter' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1a0a' : [ 0x8, { + '__unnamed_18c8' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileMaximumInformation'})]], } ], - '__unnamed_1a0c' : [ 0x10, { + '__unnamed_18ca' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileIoCompletionNotificationInformation', 42: 'FileMaximumInformation'})]], 'FileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], @@ -4885,207 +4677,207 @@ nt_types = { 'ClusterCount' : [ 0xc, ['unsigned long']], 'DeleteHandle' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1a0e' : [ 0x10, { + '__unnamed_18cc' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'EaList' : [ 0x4, ['pointer', ['void']]], 'EaListLength' : [ 0x8, ['unsigned long']], 'EaIndex' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1a10' : [ 0x4, { + '__unnamed_18ce' : [ 0x4, { 'Length' : [ 0x0, ['unsigned long']], } ], - '__unnamed_1a14' : [ 0x8, { + '__unnamed_18d2' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'FsInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsMaximumInformation'})]], } ], - '__unnamed_1a16' : [ 0x10, { + '__unnamed_18d4' : [ 0x10, { 'OutputBufferLength' : [ 0x0, ['unsigned long']], 'InputBufferLength' : [ 0x4, ['unsigned long']], 'FsControlCode' : [ 0x8, ['unsigned long']], 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1a18' : [ 0x10, { + '__unnamed_18d6' : [ 0x10, { 'Length' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], 'Key' : [ 0x4, ['unsigned long']], 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], } ], - '__unnamed_1a1a' : [ 0x10, { + '__unnamed_18d8' : [ 0x10, { 'OutputBufferLength' : [ 0x0, ['unsigned long']], 'InputBufferLength' : [ 0x4, ['unsigned long']], 'IoControlCode' : [ 0x8, ['unsigned long']], 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1a1c' : [ 0x8, { + '__unnamed_18da' : [ 0x8, { 'SecurityInformation' : [ 0x0, ['unsigned long']], 'Length' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1a1e' : [ 0x8, { + '__unnamed_18dc' : [ 0x8, { 'SecurityInformation' : [ 0x0, ['unsigned long']], 'SecurityDescriptor' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_1a20' : [ 0x8, { + '__unnamed_18de' : [ 0x8, { 'Vpb' : [ 0x0, ['pointer', ['_VPB']]], 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], } ], - '__unnamed_1a24' : [ 0x4, { + '__unnamed_18e2' : [ 0x4, { 'Srb' : [ 0x0, ['pointer', ['_SCSI_REQUEST_BLOCK']]], } ], - '__unnamed_1a28' : [ 0x10, { + '__unnamed_18e6' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'StartSid' : [ 0x4, ['pointer', ['void']]], 'SidList' : [ 0x8, ['pointer', ['_FILE_GET_QUOTA_INFORMATION']]], 'SidListLength' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1a2c' : [ 0x4, { + '__unnamed_18ea' : [ 0x4, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations'})]], } ], - '__unnamed_1a2e' : [ 0x10, { + '__unnamed_18ec' : [ 0x10, { 'InterfaceType' : [ 0x0, ['pointer', ['_GUID']]], 'Size' : [ 0x4, ['unsigned short']], 'Version' : [ 0x6, ['unsigned short']], 'Interface' : [ 0x8, ['pointer', ['_INTERFACE']]], 'InterfaceSpecificData' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1a32' : [ 0x4, { + '__unnamed_18f0' : [ 0x4, { 'Capabilities' : [ 0x0, ['pointer', ['_DEVICE_CAPABILITIES']]], } ], - '__unnamed_1a34' : [ 0x4, { + '__unnamed_18f2' : [ 0x4, { 'IoResourceRequirementList' : [ 0x0, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], } ], - '__unnamed_1a36' : [ 0x10, { + '__unnamed_18f4' : [ 0x10, { 'WhichSpace' : [ 0x0, ['unsigned long']], 'Buffer' : [ 0x4, ['pointer', ['void']]], 'Offset' : [ 0x8, ['unsigned long']], 'Length' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1a38' : [ 0x1, { + '__unnamed_18f6' : [ 0x1, { 'Lock' : [ 0x0, ['unsigned char']], } ], - '__unnamed_1a3c' : [ 0x4, { + '__unnamed_18fa' : [ 0x4, { 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber'})]], } ], - '__unnamed_1a40' : [ 0x8, { + '__unnamed_18fe' : [ 0x8, { 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], 'LocaleId' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1a44' : [ 0x8, { + '__unnamed_1902' : [ 0x8, { 'InPath' : [ 0x0, ['unsigned char']], 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile'})]], } ], - '__unnamed_1a46' : [ 0x4, { + '__unnamed_1904' : [ 0x4, { 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], } ], - '__unnamed_1a4a' : [ 0x4, { + '__unnamed_1908' : [ 0x4, { 'PowerSequence' : [ 0x0, ['pointer', ['_POWER_SEQUENCE']]], } ], - '__unnamed_1a4e' : [ 0x10, { + '__unnamed_190c' : [ 0x10, { 'SystemContext' : [ 0x0, ['unsigned long']], 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], 'State' : [ 0x8, ['_POWER_STATE']], 'ShutdownType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], } ], - '__unnamed_1a50' : [ 0x8, { + '__unnamed_190e' : [ 0x8, { 'AllocatedResources' : [ 0x0, ['pointer', ['_CM_RESOURCE_LIST']]], 'AllocatedResourcesTranslated' : [ 0x4, ['pointer', ['_CM_RESOURCE_LIST']]], } ], - '__unnamed_1a52' : [ 0x10, { + '__unnamed_1910' : [ 0x10, { 'ProviderId' : [ 0x0, ['unsigned long']], 'DataPath' : [ 0x4, ['pointer', ['void']]], 'BufferSize' : [ 0x8, ['unsigned long']], 'Buffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1a54' : [ 0x10, { + '__unnamed_1912' : [ 0x10, { 'Argument1' : [ 0x0, ['pointer', ['void']]], 'Argument2' : [ 0x4, ['pointer', ['void']]], 'Argument3' : [ 0x8, ['pointer', ['void']]], 'Argument4' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1a56' : [ 0x10, { - 'Create' : [ 0x0, ['__unnamed_19f8']], - 'CreatePipe' : [ 0x0, ['__unnamed_19fc']], - 'CreateMailslot' : [ 0x0, ['__unnamed_1a00']], - 'Read' : [ 0x0, ['__unnamed_1a02']], - 'Write' : [ 0x0, ['__unnamed_1a02']], - 'QueryDirectory' : [ 0x0, ['__unnamed_1a06']], - 'NotifyDirectory' : [ 0x0, ['__unnamed_1a08']], - 'QueryFile' : [ 0x0, ['__unnamed_1a0a']], - 'SetFile' : [ 0x0, ['__unnamed_1a0c']], - 'QueryEa' : [ 0x0, ['__unnamed_1a0e']], - 'SetEa' : [ 0x0, ['__unnamed_1a10']], - 'QueryVolume' : [ 0x0, ['__unnamed_1a14']], - 'SetVolume' : [ 0x0, ['__unnamed_1a14']], - 'FileSystemControl' : [ 0x0, ['__unnamed_1a16']], - 'LockControl' : [ 0x0, ['__unnamed_1a18']], - 'DeviceIoControl' : [ 0x0, ['__unnamed_1a1a']], - 'QuerySecurity' : [ 0x0, ['__unnamed_1a1c']], - 'SetSecurity' : [ 0x0, ['__unnamed_1a1e']], - 'MountVolume' : [ 0x0, ['__unnamed_1a20']], - 'VerifyVolume' : [ 0x0, ['__unnamed_1a20']], - 'Scsi' : [ 0x0, ['__unnamed_1a24']], - 'QueryQuota' : [ 0x0, ['__unnamed_1a28']], - 'SetQuota' : [ 0x0, ['__unnamed_1a10']], - 'QueryDeviceRelations' : [ 0x0, ['__unnamed_1a2c']], - 'QueryInterface' : [ 0x0, ['__unnamed_1a2e']], - 'DeviceCapabilities' : [ 0x0, ['__unnamed_1a32']], - 'FilterResourceRequirements' : [ 0x0, ['__unnamed_1a34']], - 'ReadWriteConfig' : [ 0x0, ['__unnamed_1a36']], - 'SetLock' : [ 0x0, ['__unnamed_1a38']], - 'QueryId' : [ 0x0, ['__unnamed_1a3c']], - 'QueryDeviceText' : [ 0x0, ['__unnamed_1a40']], - 'UsageNotification' : [ 0x0, ['__unnamed_1a44']], - 'WaitWake' : [ 0x0, ['__unnamed_1a46']], - 'PowerSequence' : [ 0x0, ['__unnamed_1a4a']], - 'Power' : [ 0x0, ['__unnamed_1a4e']], - 'StartDevice' : [ 0x0, ['__unnamed_1a50']], - 'WMI' : [ 0x0, ['__unnamed_1a52']], - 'Others' : [ 0x0, ['__unnamed_1a54']], + '__unnamed_1914' : [ 0x10, { + 'Create' : [ 0x0, ['__unnamed_18b6']], + 'CreatePipe' : [ 0x0, ['__unnamed_18ba']], + 'CreateMailslot' : [ 0x0, ['__unnamed_18be']], + 'Read' : [ 0x0, ['__unnamed_18c0']], + 'Write' : [ 0x0, ['__unnamed_18c0']], + 'QueryDirectory' : [ 0x0, ['__unnamed_18c4']], + 'NotifyDirectory' : [ 0x0, ['__unnamed_18c6']], + 'QueryFile' : [ 0x0, ['__unnamed_18c8']], + 'SetFile' : [ 0x0, ['__unnamed_18ca']], + 'QueryEa' : [ 0x0, ['__unnamed_18cc']], + 'SetEa' : [ 0x0, ['__unnamed_18ce']], + 'QueryVolume' : [ 0x0, ['__unnamed_18d2']], + 'SetVolume' : [ 0x0, ['__unnamed_18d2']], + 'FileSystemControl' : [ 0x0, ['__unnamed_18d4']], + 'LockControl' : [ 0x0, ['__unnamed_18d6']], + 'DeviceIoControl' : [ 0x0, ['__unnamed_18d8']], + 'QuerySecurity' : [ 0x0, ['__unnamed_18da']], + 'SetSecurity' : [ 0x0, ['__unnamed_18dc']], + 'MountVolume' : [ 0x0, ['__unnamed_18de']], + 'VerifyVolume' : [ 0x0, ['__unnamed_18de']], + 'Scsi' : [ 0x0, ['__unnamed_18e2']], + 'QueryQuota' : [ 0x0, ['__unnamed_18e6']], + 'SetQuota' : [ 0x0, ['__unnamed_18ce']], + 'QueryDeviceRelations' : [ 0x0, ['__unnamed_18ea']], + 'QueryInterface' : [ 0x0, ['__unnamed_18ec']], + 'DeviceCapabilities' : [ 0x0, ['__unnamed_18f0']], + 'FilterResourceRequirements' : [ 0x0, ['__unnamed_18f2']], + 'ReadWriteConfig' : [ 0x0, ['__unnamed_18f4']], + 'SetLock' : [ 0x0, ['__unnamed_18f6']], + 'QueryId' : [ 0x0, ['__unnamed_18fa']], + 'QueryDeviceText' : [ 0x0, ['__unnamed_18fe']], + 'UsageNotification' : [ 0x0, ['__unnamed_1902']], + 'WaitWake' : [ 0x0, ['__unnamed_1904']], + 'PowerSequence' : [ 0x0, ['__unnamed_1908']], + 'Power' : [ 0x0, ['__unnamed_190c']], + 'StartDevice' : [ 0x0, ['__unnamed_190e']], + 'WMI' : [ 0x0, ['__unnamed_1910']], + 'Others' : [ 0x0, ['__unnamed_1912']], } ], '_IO_STACK_LOCATION' : [ 0x24, { 'MajorFunction' : [ 0x0, ['unsigned char']], 'MinorFunction' : [ 0x1, ['unsigned char']], 'Flags' : [ 0x2, ['unsigned char']], 'Control' : [ 0x3, ['unsigned char']], - 'Parameters' : [ 0x4, ['__unnamed_1a56']], + 'Parameters' : [ 0x4, ['__unnamed_1914']], 'DeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], 'FileObject' : [ 0x18, ['pointer', ['_FILE_OBJECT']]], 'CompletionRoutine' : [ 0x1c, ['pointer', ['void']]], 'Context' : [ 0x20, ['pointer', ['void']]], } ], - '__unnamed_1a5d' : [ 0x18, { + '__unnamed_191b' : [ 0x18, { 'Length' : [ 0x0, ['unsigned long']], 'Alignment' : [ 0x4, ['unsigned long']], 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], } ], - '__unnamed_1a5f' : [ 0x8, { + '__unnamed_191d' : [ 0x8, { 'MinimumVector' : [ 0x0, ['unsigned long']], 'MaximumVector' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1a61' : [ 0x8, { + '__unnamed_191f' : [ 0x8, { 'MinimumChannel' : [ 0x0, ['unsigned long']], 'MaximumChannel' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1a63' : [ 0x10, { + '__unnamed_1921' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'MinBusNumber' : [ 0x4, ['unsigned long']], 'MaxBusNumber' : [ 0x8, ['unsigned long']], 'Reserved' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1a65' : [ 0xc, { + '__unnamed_1923' : [ 0xc, { 'Priority' : [ 0x0, ['unsigned long']], 'Reserved1' : [ 0x4, ['unsigned long']], 'Reserved2' : [ 0x8, ['unsigned long']], } ], - '__unnamed_1a67' : [ 0x18, { - 'Port' : [ 0x0, ['__unnamed_1a5d']], - 'Memory' : [ 0x0, ['__unnamed_1a5d']], - 'Interrupt' : [ 0x0, ['__unnamed_1a5f']], - 'Dma' : [ 0x0, ['__unnamed_1a61']], - 'Generic' : [ 0x0, ['__unnamed_1a5d']], - 'DevicePrivate' : [ 0x0, ['__unnamed_17c4']], - 'BusNumber' : [ 0x0, ['__unnamed_1a63']], - 'ConfigData' : [ 0x0, ['__unnamed_1a65']], + '__unnamed_1925' : [ 0x18, { + 'Port' : [ 0x0, ['__unnamed_191b']], + 'Memory' : [ 0x0, ['__unnamed_191b']], + 'Interrupt' : [ 0x0, ['__unnamed_191d']], + 'Dma' : [ 0x0, ['__unnamed_191f']], + 'Generic' : [ 0x0, ['__unnamed_191b']], + 'DevicePrivate' : [ 0x0, ['__unnamed_1683']], + 'BusNumber' : [ 0x0, ['__unnamed_1921']], + 'ConfigData' : [ 0x0, ['__unnamed_1923']], } ], '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { 'Option' : [ 0x0, ['unsigned char']], @@ -5094,35 +4886,41 @@ nt_types = { 'Spare1' : [ 0x3, ['unsigned char']], 'Flags' : [ 0x4, ['unsigned short']], 'Spare2' : [ 0x6, ['unsigned short']], - 'u' : [ 0x8, ['__unnamed_1a67']], + 'u' : [ 0x8, ['__unnamed_1925']], } ], '_MI_VERIFIER_POOL_HEADER' : [ 0x4, { 'VerifierPoolEntry' : [ 0x0, ['pointer', ['_VI_POOL_ENTRY']]], } ], - '__unnamed_1a70' : [ 0x4, { + '__unnamed_192e' : [ 0x4, { 'DataLength' : [ 0x0, ['short']], 'TotalLength' : [ 0x2, ['short']], } ], - '__unnamed_1a72' : [ 0x4, { - 's1' : [ 0x0, ['__unnamed_1a70']], + '__unnamed_1930' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_192e']], 'Length' : [ 0x0, ['unsigned long']], } ], - '__unnamed_1a74' : [ 0x4, { + '__unnamed_1932' : [ 0x4, { 'Type' : [ 0x0, ['short']], 'DataInfoOffset' : [ 0x2, ['short']], } ], - '__unnamed_1a76' : [ 0x4, { - 's2' : [ 0x0, ['__unnamed_1a74']], + '__unnamed_1934' : [ 0x4, { + 's2' : [ 0x0, ['__unnamed_1932']], 'ZeroInit' : [ 0x0, ['unsigned long']], } ], '_PORT_MESSAGE' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_1a72']], - 'u2' : [ 0x4, ['__unnamed_1a76']], + 'u1' : [ 0x0, ['__unnamed_1930']], + 'u2' : [ 0x4, ['__unnamed_1934']], 'ClientId' : [ 0x8, ['_CLIENT_ID']], 'DoNotUseThisField' : [ 0x8, ['double']], 'MessageId' : [ 0x10, ['unsigned long']], 'ClientViewSize' : [ 0x14, ['unsigned long']], 'CallbackId' : [ 0x14, ['unsigned long']], +} ], + '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { + 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], + 'AlphaControlSet' : [ 0x0, ['unsigned long']], + 'IA64ControlSet' : [ 0x0, ['_IA64_DBGKD_CONTROL_SET']], + 'Amd64ControlSet' : [ 0x0, ['_AMD64_DBGKD_CONTROL_SET']], } ], '_ARBITER_ORDERING_LIST' : [ 0x8, { 'Count' : [ 0x0, ['unsigned short']], @@ -5244,26 +5042,26 @@ nt_types = { 'Parameter3' : [ 0xc, ['unsigned long']], 'Parameter4' : [ 0x10, ['unsigned long']], } ], - '__unnamed_1aa8' : [ 0x4, { - 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32)]], + '__unnamed_196a' : [ 0x4, { + 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], } ], - '__unnamed_1aaa' : [ 0x4, { - 'bits' : [ 0x0, ['__unnamed_1aa8']], + '__unnamed_196c' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_196a']], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_PCI_SLOT_NUMBER' : [ 0x4, { - 'u' : [ 0x0, ['__unnamed_1aaa']], + 'u' : [ 0x0, ['__unnamed_196c']], } ], '_CM_NOTIFY_BLOCK' : [ 0x2c, { 'HiveList' : [ 0x0, ['_LIST_ENTRY']], 'PostList' : [ 0x8, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x10, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x14, ['pointer', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_SID' : [ 0xc, { @@ -5340,51 +5138,46 @@ nt_types = { 'FsFilterCallbacks' : [ 0x18, ['pointer', ['_FS_FILTER_CALLBACKS']]], } ], '_PM_SUPPORT' : [ 0x1, { - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], - '__unnamed_1ad9' : [ 0xc, { + '__unnamed_199b' : [ 0xc, { 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], 'AllocateFromCount' : [ 0x4, ['unsigned long']], 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], } ], - '__unnamed_1adb' : [ 0x4, { + '__unnamed_199d' : [ 0x4, { 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], } ], - '__unnamed_1adf' : [ 0x4, { + '__unnamed_19a1' : [ 0x4, { 'AllocatedResources' : [ 0x0, ['pointer', ['pointer', ['_CM_PARTIAL_RESOURCE_LIST']]]], } ], - '__unnamed_1ae1' : [ 0x10, { + '__unnamed_19a3' : [ 0x10, { 'PhysicalDeviceObject' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], 'ConflictingResource' : [ 0x4, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], 'ConflictCount' : [ 0x8, ['pointer', ['unsigned long']]], 'Conflicts' : [ 0xc, ['pointer', ['pointer', ['_ARBITER_CONFLICT_INFO']]]], } ], - '__unnamed_1ae3' : [ 0x4, { + '__unnamed_19a5' : [ 0x4, { 'ReserveDevice' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], } ], - '__unnamed_1ae5' : [ 0x10, { - 'TestAllocation' : [ 0x0, ['__unnamed_1ad9']], - 'RetestAllocation' : [ 0x0, ['__unnamed_1ad9']], - 'BootAllocation' : [ 0x0, ['__unnamed_1adb']], - 'QueryAllocatedResources' : [ 0x0, ['__unnamed_1adf']], - 'QueryConflict' : [ 0x0, ['__unnamed_1ae1']], - 'QueryArbitrate' : [ 0x0, ['__unnamed_1adb']], - 'AddReserved' : [ 0x0, ['__unnamed_1ae3']], + '__unnamed_19a7' : [ 0x10, { + 'TestAllocation' : [ 0x0, ['__unnamed_199b']], + 'RetestAllocation' : [ 0x0, ['__unnamed_199b']], + 'BootAllocation' : [ 0x0, ['__unnamed_199d']], + 'QueryAllocatedResources' : [ 0x0, ['__unnamed_19a1']], + 'QueryConflict' : [ 0x0, ['__unnamed_19a3']], + 'QueryArbitrate' : [ 0x0, ['__unnamed_199d']], + 'AddReserved' : [ 0x0, ['__unnamed_19a5']], } ], '_ARBITER_PARAMETERS' : [ 0x10, { - 'Parameters' : [ 0x0, ['__unnamed_1ae5']], -} ], - 'POWER_ACTION_POLICY' : [ 0xc, { - 'Action' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], - 'Flags' : [ 0x4, ['unsigned long']], - 'EventCode' : [ 0x8, ['unsigned long']], + 'Parameters' : [ 0x0, ['__unnamed_19a7']], } ], '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { 'AuditMask' : [ 0x0, ['unsigned long']], @@ -5397,6 +5190,29 @@ nt_types = { '_IMAGE_DATA_DIRECTORY' : [ 0x8, { 'VirtualAddress' : [ 0x0, ['unsigned long']], 'Size' : [ 0x4, ['unsigned long']], +} ], + '_CURDIR' : [ 0xc, { + 'DosPath' : [ 0x0, ['_UNICODE_STRING']], + 'Handle' : [ 0x8, ['pointer', ['void']]], +} ], + '_PO_HIBER_PERF' : [ 0x48, { + 'IoTicks' : [ 0x0, ['unsigned long long']], + 'InitTicks' : [ 0x8, ['unsigned long long']], + 'CopyTicks' : [ 0x10, ['unsigned long long']], + 'StartCount' : [ 0x18, ['unsigned long long']], + 'ElapsedTime' : [ 0x20, ['unsigned long']], + 'IoTime' : [ 0x24, ['unsigned long']], + 'CopyTime' : [ 0x28, ['unsigned long']], + 'InitTime' : [ 0x2c, ['unsigned long']], + 'PagesWritten' : [ 0x30, ['unsigned long']], + 'PagesProcessed' : [ 0x34, ['unsigned long']], + 'BytesCopied' : [ 0x38, ['unsigned long']], + 'DumpCount' : [ 0x3c, ['unsigned long']], + 'FileRuns' : [ 0x40, ['unsigned long']], +} ], + '_FREE_DISPLAY' : [ 0xc, { + 'RealVectorSize' : [ 0x0, ['unsigned long']], + 'Display' : [ 0x4, ['_RTL_BITMAP']], } ], 'PO_MEMORY_IMAGE' : [ 0xa8, { 'Signature' : [ 0x0, ['unsigned long']], @@ -5425,29 +5241,6 @@ nt_types = { 'BATTERY_REPORTING_SCALE' : [ 0x8, { 'Granularity' : [ 0x0, ['unsigned long']], 'Capacity' : [ 0x4, ['unsigned long']], -} ], - '_CURDIR' : [ 0xc, { - 'DosPath' : [ 0x0, ['_UNICODE_STRING']], - 'Handle' : [ 0x8, ['pointer', ['void']]], -} ], - '_PO_HIBER_PERF' : [ 0x48, { - 'IoTicks' : [ 0x0, ['unsigned long long']], - 'InitTicks' : [ 0x8, ['unsigned long long']], - 'CopyTicks' : [ 0x10, ['unsigned long long']], - 'StartCount' : [ 0x18, ['unsigned long long']], - 'ElapsedTime' : [ 0x20, ['unsigned long']], - 'IoTime' : [ 0x24, ['unsigned long']], - 'CopyTime' : [ 0x28, ['unsigned long']], - 'InitTime' : [ 0x2c, ['unsigned long']], - 'PagesWritten' : [ 0x30, ['unsigned long']], - 'PagesProcessed' : [ 0x34, ['unsigned long']], - 'BytesCopied' : [ 0x38, ['unsigned long']], - 'DumpCount' : [ 0x3c, ['unsigned long']], - 'FileRuns' : [ 0x40, ['unsigned long']], -} ], - '_FREE_DISPLAY' : [ 0xc, { - 'RealVectorSize' : [ 0x0, ['unsigned long']], - 'Display' : [ 0x4, ['_RTL_BITMAP']], } ], '_KDEVICE_QUEUE_ENTRY' : [ 0x10, { 'DeviceListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -5457,25 +5250,25 @@ nt_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -5505,47 +5298,47 @@ nt_types = { 'ContentionCount' : [ 0x14, ['unsigned long']], 'Spare' : [ 0x18, ['array', 2, ['unsigned long']]], } ], - '__unnamed_1b07' : [ 0x14, { + '__unnamed_19c7' : [ 0x14, { 'ClassGuid' : [ 0x0, ['_GUID']], - 'SymbolicLinkName' : [ 0x10, ['array', 1, ['wchar']]], + 'SymbolicLinkName' : [ 0x10, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1b09' : [ 0x2, { - 'DeviceIds' : [ 0x0, ['array', 1, ['wchar']]], + '__unnamed_19c9' : [ 0x2, { + 'DeviceIds' : [ 0x0, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1b0b' : [ 0x2, { - 'DeviceId' : [ 0x0, ['array', 1, ['wchar']]], + '__unnamed_19cb' : [ 0x2, { + 'DeviceId' : [ 0x0, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1b0d' : [ 0x8, { + '__unnamed_19cd' : [ 0x8, { 'NotificationStructure' : [ 0x0, ['pointer', ['void']]], - 'DeviceIds' : [ 0x4, ['array', 1, ['wchar']]], + 'DeviceIds' : [ 0x4, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1b0f' : [ 0x4, { + '__unnamed_19cf' : [ 0x4, { 'Notification' : [ 0x0, ['pointer', ['void']]], } ], - '__unnamed_1b11' : [ 0x8, { + '__unnamed_19d1' : [ 0x8, { 'NotificationCode' : [ 0x0, ['unsigned long']], 'NotificationData' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1b13' : [ 0x8, { + '__unnamed_19d3' : [ 0x8, { 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], - 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['wchar']]], + 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1b15' : [ 0x10, { + '__unnamed_19d5' : [ 0x10, { 'BlockedDriverGuid' : [ 0x0, ['_GUID']], } ], - '__unnamed_1b17' : [ 0x2, { - 'ParentId' : [ 0x0, ['array', 1, ['wchar']]], + '__unnamed_19d7' : [ 0x2, { + 'ParentId' : [ 0x0, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1b19' : [ 0x14, { - 'DeviceClass' : [ 0x0, ['__unnamed_1b07']], - 'TargetDevice' : [ 0x0, ['__unnamed_1b09']], - 'InstallDevice' : [ 0x0, ['__unnamed_1b0b']], - 'CustomNotification' : [ 0x0, ['__unnamed_1b0d']], - 'ProfileNotification' : [ 0x0, ['__unnamed_1b0f']], - 'PowerNotification' : [ 0x0, ['__unnamed_1b11']], - 'VetoNotification' : [ 0x0, ['__unnamed_1b13']], - 'BlockedDriverNotification' : [ 0x0, ['__unnamed_1b15']], - 'InvalidIDNotification' : [ 0x0, ['__unnamed_1b17']], + '__unnamed_19d9' : [ 0x14, { + 'DeviceClass' : [ 0x0, ['__unnamed_19c7']], + 'TargetDevice' : [ 0x0, ['__unnamed_19c9']], + 'InstallDevice' : [ 0x0, ['__unnamed_19cb']], + 'CustomNotification' : [ 0x0, ['__unnamed_19cd']], + 'ProfileNotification' : [ 0x0, ['__unnamed_19cf']], + 'PowerNotification' : [ 0x0, ['__unnamed_19d1']], + 'VetoNotification' : [ 0x0, ['__unnamed_19d3']], + 'BlockedDriverNotification' : [ 0x0, ['__unnamed_19d5']], + 'InvalidIDNotification' : [ 0x0, ['__unnamed_19d7']], } ], '_PLUGPLAY_EVENT_BLOCK' : [ 0x38, { 'EventGuid' : [ 0x0, ['_GUID']], @@ -5554,7 +5347,7 @@ nt_types = { 'Flags' : [ 0x18, ['unsigned long']], 'TotalSize' : [ 0x1c, ['unsigned long']], 'DeviceObject' : [ 0x20, ['pointer', ['void']]], - 'u' : [ 0x24, ['__unnamed_1b19']], + 'u' : [ 0x24, ['__unnamed_19d9']], } ], '_CACHED_CHILD_LIST' : [ 0x8, { 'Count' : [ 0x0, ['unsigned long']], @@ -5565,16 +5358,16 @@ nt_types = { 'Range' : [ 0x0, ['_PO_MEMORY_RANGE_ARRAY_RANGE']], 'Link' : [ 0x0, ['_PO_MEMORY_RANGE_ARRAY_LINK']], } ], - '__unnamed_1b2e' : [ 0x8, { + '__unnamed_19f0' : [ 0x8, { 'Signature' : [ 0x0, ['unsigned long']], 'CheckSum' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1b30' : [ 0x10, { + '__unnamed_19f2' : [ 0x10, { 'DiskId' : [ 0x0, ['_GUID']], } ], - '__unnamed_1b32' : [ 0x10, { - 'Mbr' : [ 0x0, ['__unnamed_1b2e']], - 'Gpt' : [ 0x0, ['__unnamed_1b30']], + '__unnamed_19f4' : [ 0x10, { + 'Mbr' : [ 0x0, ['__unnamed_19f0']], + 'Gpt' : [ 0x0, ['__unnamed_19f2']], } ], '_DUMP_INITIALIZATION_CONTEXT' : [ 0x70, { 'Length' : [ 0x0, ['unsigned long']], @@ -5595,7 +5388,7 @@ nt_types = { 'TargetAddress' : [ 0x50, ['pointer', ['void']]], 'WritePendingRoutine' : [ 0x54, ['pointer', ['void']]], 'PartitionStyle' : [ 0x58, ['unsigned long']], - 'DiskInfo' : [ 0x5c, ['__unnamed_1b32']], + 'DiskInfo' : [ 0x5c, ['__unnamed_19f4']], } ], '_IO_CLIENT_EXTENSION' : [ 0x8, { 'NextExtension' : [ 0x0, ['pointer', ['_IO_CLIENT_EXTENSION']]], @@ -5605,7 +5398,7 @@ nt_types = { 'ConvKey' : [ 0x0, ['unsigned long']], 'NextHash' : [ 0x4, ['pointer', ['_CM_NAME_HASH']]], 'NameLength' : [ 0x8, ['unsigned short']], - 'Name' : [ 0xa, ['array', 1, ['wchar']]], + 'Name' : [ 0xa, ['array', 1, ['unsigned short']]], } ], '_ARBITER_ALLOCATION_STATE' : [ 0x38, { 'Start' : [ 0x0, ['unsigned long long']], @@ -5655,6 +5448,11 @@ nt_types = { 'PostAcquireForModifiedPageWriter' : [ 0x2c, ['pointer', ['void']]], 'PreReleaseForModifiedPageWriter' : [ 0x30, ['pointer', ['void']]], 'PostReleaseForModifiedPageWriter' : [ 0x34, ['pointer', ['void']]], +} ], + '_IA64_DBGKD_CONTROL_SET' : [ 0x14, { + 'Continue' : [ 0x0, ['unsigned long']], + 'CurrentSymbolStart' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0xc, ['unsigned long long']], } ], '_PO_MEMORY_RANGE_ARRAY_RANGE' : [ 0x10, { 'PageNo' : [ 0x0, ['unsigned long']], @@ -5669,7 +5467,7 @@ nt_types = { 'KeyIndex' : [ 0x0, ['_CM_KEY_INDEX']], 'ValueData' : [ 0x0, ['_CM_BIG_DATA']], 'KeyList' : [ 0x0, ['array', 1, ['unsigned long']]], - 'KeyString' : [ 0x0, ['array', 1, ['wchar']]], + 'KeyString' : [ 0x0, ['array', 1, ['unsigned short']]], } ], '_ARBITER_CONFLICT_INFO' : [ 0x18, { 'OwningObject' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], @@ -5687,7 +5485,7 @@ nt_types = { 'ReadyS0' : [ 0x38, ['_LIST_ENTRY']], 'WaitS0' : [ 0x40, ['_LIST_ENTRY']], } ], - '__unnamed_1b60' : [ 0x8, { + '__unnamed_1a24' : [ 0x8, { 'Base' : [ 0x0, ['unsigned long']], 'Limit' : [ 0x4, ['unsigned long']], } ], @@ -5700,7 +5498,7 @@ nt_types = { 'SecondaryBus' : [ 0x9, ['unsigned char']], 'SubordinateBus' : [ 0xa, ['unsigned char']], 'SecondaryLatency' : [ 0xb, ['unsigned char']], - 'Range' : [ 0xc, ['array', 4, ['__unnamed_1b60']]], + 'Range' : [ 0xc, ['array', 4, ['__unnamed_1a24']]], 'InterruptLine' : [ 0x2c, ['unsigned char']], 'InterruptPin' : [ 0x2d, ['unsigned char']], 'BridgeControl' : [ 0x2e, ['unsigned short']], @@ -5713,7 +5511,13 @@ nt_types = { 'Type' : [ 0xc, ['unsigned long']], 'Flags' : [ 0x10, ['unsigned short']], 'Spare' : [ 0x12, ['unsigned short']], - 'Name' : [ 0x14, ['array', 1, ['wchar']]], + 'Name' : [ 0x14, ['array', 1, ['unsigned short']]], +} ], + '_AMD64_DBGKD_CONTROL_SET' : [ 0x1c, { + 'TraceFlag' : [ 0x0, ['unsigned long']], + 'Dr7' : [ 0x4, ['unsigned long long']], + 'CurrentSymbolStart' : [ 0xc, ['unsigned long long']], + 'CurrentSymbolEnd' : [ 0x14, ['unsigned long long']], } ], '_FS_FILTER_CALLBACK_DATA' : [ 0x24, { 'SizeOfFsFilterCallbackData' : [ 0x0, ['unsigned long']], @@ -5885,17 +5689,17 @@ nt_types = { 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], 'Security' : [ 0x2c, ['unsigned long']], 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'MaxClassLen' : [ 0x38, ['unsigned long']], 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], 'MaxValueDataLen' : [ 0x40, ['unsigned long']], 'WorkVar' : [ 0x44, ['unsigned long']], 'NameLength' : [ 0x48, ['unsigned short']], 'ClassLength' : [ 0x4a, ['unsigned short']], - 'Name' : [ 0x4c, ['array', 1, ['wchar']]], + 'Name' : [ 0x4c, ['array', 1, ['unsigned short']]], } ], '_ARBITER_ORDERING' : [ 0x10, { 'Start' : [ 0x0, ['unsigned long long']], @@ -5948,18 +5752,18 @@ nt_types = { 'Descriptor' : [ 0x20, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], 'Reserved' : [ 0x24, ['array', 3, ['unsigned long']]], } ], - '__unnamed_1be6' : [ 0x8, { + '__unnamed_1aad' : [ 0x8, { 'EndingOffset' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], 'ResourceToRelease' : [ 0x4, ['pointer', ['pointer', ['_ERESOURCE']]]], } ], - '__unnamed_1be8' : [ 0x4, { + '__unnamed_1aaf' : [ 0x4, { 'ResourceToRelease' : [ 0x0, ['pointer', ['_ERESOURCE']]], } ], - '__unnamed_1bec' : [ 0x8, { + '__unnamed_1ab3' : [ 0x8, { 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], 'PageProtection' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1bee' : [ 0x14, { + '__unnamed_1ab5' : [ 0x14, { 'Argument1' : [ 0x0, ['pointer', ['void']]], 'Argument2' : [ 0x4, ['pointer', ['void']]], 'Argument3' : [ 0x8, ['pointer', ['void']]], @@ -5967,10 +5771,10 @@ nt_types = { 'Argument5' : [ 0x10, ['pointer', ['void']]], } ], '_FS_FILTER_PARAMETERS' : [ 0x14, { - 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_1be6']], - 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_1be8']], - 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_1bec']], - 'Others' : [ 0x0, ['__unnamed_1bee']], + 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_1aad']], + 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_1aaf']], + 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_1ab3']], + 'Others' : [ 0x0, ['__unnamed_1ab5']], } ], '_COMPRESSED_DATA_INFO' : [ 0xc, { 'CompressionFormatAndEngine' : [ 0x0, ['unsigned short']], diff --git a/volatility/plugins/overlays/windows/win7_sp0_x64_vtypes.py b/volatility/plugins/overlays/windows/win7_sp0_x64_vtypes.py index 16672d90..ebd25664 100644 --- a/volatility/plugins/overlays/windows/win7_sp0_x64_vtypes.py +++ b/volatility/plugins/overlays/windows/win7_sp0_x64_vtypes.py @@ -123,10 +123,10 @@ ntkrnlmp_types = { 'BankTemplate' : [ 0x30, ['array', 1, ['_MMPTE']]], } ], '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { - 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_XSAVE_AREA_HEADER' : [ 0x40, { @@ -235,9 +235,9 @@ ntkrnlmp_types = { } ], '__unnamed_205d' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_PERF_STATES' : [ 0xb0, { 'Count' : [ 0x0, ['unsigned long']], @@ -381,10 +381,10 @@ ntkrnlmp_types = { '_IMAGE_SECURITY_CONTEXT' : [ 0x8, { 'PageHashes' : [ 0x0, ['pointer64', ['void']]], 'Value' : [ 0x0, ['unsigned long long']], - 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64)]], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_209f' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], @@ -436,11 +436,11 @@ ntkrnlmp_types = { '_KIDTENTRY64' : [ 0x10, { 'OffsetLow' : [ 0x0, ['unsigned short']], 'Selector' : [ 0x2, ['unsigned short']], - 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned short')]], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned short')]], + 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned short')]], + 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], 'OffsetMiddle' : [ 0x6, ['unsigned short']], 'OffsetHigh' : [ 0x8, ['unsigned long']], 'Reserved1' : [ 0xc, ['unsigned long']], @@ -470,10 +470,10 @@ ntkrnlmp_types = { 'FirmwareDescriptorListHead' : [ 0x60, ['_LIST_ENTRY']], 'AcpiTable' : [ 0x70, ['pointer64', ['void']]], 'AcpiTableSize' : [ 0x78, ['unsigned long']], - 'LastBootSucceeded' : [ 0x7c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LastBootShutdown' : [ 0x7c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IoPortAccessSupported' : [ 0x7c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x7c, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'LastBootSucceeded' : [ 0x7c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LastBootShutdown' : [ 0x7c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoPortAccessSupported' : [ 0x7c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x7c, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'LoaderPerformanceData' : [ 0x80, ['pointer64', ['_LOADER_PERFORMANCE_DATA']]], 'BootApplicationPersistentData' : [ 0x88, ['_LIST_ENTRY']], 'WmdTestResult' : [ 0x98, ['pointer64', ['void']]], @@ -520,8 +520,8 @@ ntkrnlmp_types = { 'RspOffset' : [ 0x30, ['unsigned long long']], 'Rip' : [ 0x38, ['unsigned long long']], 'FltSave' : [ 0x40, ['pointer64', ['_XSAVE_FORMAT']]], - 'Volatile' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 64)]], + 'Volatile' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 64, native_type='unsigned long long')]], 'Flags' : [ 0x48, ['unsigned long long']], 'TrapFrame' : [ 0x50, ['pointer64', ['_KTRAP_FRAME']]], 'ExceptionFrame' : [ 0x58, ['pointer64', ['_KEXCEPTION_FRAME']]], @@ -565,11 +565,11 @@ ntkrnlmp_types = { 'PageCount' : [ 0x8, ['unsigned long long']], } ], '_RTL_SRWLOCK' : [ 0x8, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], 'Ptr' : [ 0x0, ['pointer64', ['void']]], } ], @@ -668,10 +668,10 @@ ntkrnlmp_types = { 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], } ], '_POOL_HEADER' : [ 0x10, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'ProcessBilled' : [ 0x8, ['pointer64', ['_EPROCESS']]], @@ -689,12 +689,12 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['unsigned long long']], 'ImageBaseAddress' : [ 0x10, ['unsigned long long']], 'Ldr' : [ 0x18, ['unsigned long long']], @@ -705,12 +705,12 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x40, ['unsigned long long']], 'IFEOKey' : [ 0x48, ['unsigned long long']], 'CrossProcessFlags' : [ 0x50, ['unsigned long']], - 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32)]], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x58, ['unsigned long long']], 'UserSharedInfoPtr' : [ 0x58, ['unsigned long long']], 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], @@ -773,9 +773,9 @@ ntkrnlmp_types = { 'pContextData' : [ 0x368, ['unsigned long long']], 'pImageHeaderHash' : [ 0x370, ['unsigned long long']], 'TracingFlags' : [ 0x378, ['unsigned long']], - 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_SE_AUDIT_PROCESS_CREATION_INFO' : [ 0x8, { 'ImageFileName' : [ 0x0, ['pointer64', ['_OBJECT_NAME_INFORMATION']]], @@ -847,8 +847,8 @@ ntkrnlmp_types = { } ], '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x10, { 'Process' : [ 0x0, ['pointer64', ['_EPROCESS']]], - 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_CLIENT_ID' : [ 0x10, { 'UniqueProcess' : [ 0x0, ['pointer64', ['void']]], @@ -874,18 +874,18 @@ ntkrnlmp_types = { } ], '_KWAIT_STATUS_REGISTER' : [ 0x1, { 'Flags' : [ 0x0, ['unsigned char']], - 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Priority' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Apc' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Alert' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Apc' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Alert' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_VI_DEADLOCK_RESOURCE' : [ 0xf8, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockInStackQueuedSpinLock', 7: 'VfDeadlockUnusedSpinLock', 8: 'VfDeadlockEresource', 9: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer64', ['void']]], 'ThreadOwner' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x18, ['_LIST_ENTRY']], @@ -903,33 +903,33 @@ ntkrnlmp_types = { 'Length' : [ 0x10, ['unsigned long']], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], } ], '_SECURITY_CLIENT_CONTEXT' : [ 0x48, { 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], @@ -1071,16 +1071,16 @@ ntkrnlmp_types = { 'BaseHigh' : [ 0x3, ['unsigned char']], } ], '__unnamed_21c3' : [ 0x4, { - 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_KGDTENTRY64' : [ 0x10, { 'LimitLow' : [ 0x0, ['unsigned short']], @@ -1184,9 +1184,9 @@ ntkrnlmp_types = { } ], '__unnamed_21e9' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { 'Revision' : [ 0x0, ['unsigned short']], @@ -1305,8 +1305,8 @@ ntkrnlmp_types = { 'ReasonSize' : [ 0x18, ['unsigned long long']], } ], '__unnamed_220c' : [ 0x4, { - 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_220e' : [ 0x4, { 'Flags' : [ 0x0, ['__unnamed_220c']], @@ -1379,10 +1379,10 @@ ntkrnlmp_types = { 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], 'Security' : [ 0x2c, ['unsigned long']], 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'MaxClassLen' : [ 0x38, ['unsigned long']], 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], 'MaxValueDataLen' : [ 0x40, ['unsigned long']], @@ -1417,10 +1417,10 @@ ntkrnlmp_types = { 'Offset' : [ 0x30, ['unsigned long']], 'Length' : [ 0x34, ['unsigned long']], 'Page' : [ 0x38, ['unsigned long long']], - 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'Spare' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Spare' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'CallingAddress' : [ 0x48, ['pointer64', ['void']]], 'CallersCaller' : [ 0x50, ['pointer64', ['void']]], } ], @@ -1574,18 +1574,18 @@ ntkrnlmp_types = { 'TimeRefreshLockAcquired' : [ 0x2f4, ['unsigned char']], } ], '_SEGMENT_FLAGS' : [ 0x4, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22)]], - 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'ContainsDebug' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22, native_type='unsigned long')]], + 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'ContainsDebug' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_VF_KE_CRITICAL_REGION_TRACE' : [ 0x40, { 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], @@ -1693,20 +1693,20 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], - 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0xfca, ['unsigned short']], - 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16)]], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], @@ -1795,22 +1795,22 @@ ntkrnlmp_types = { 'FileAttributes' : [ 0x30, ['unsigned long']], } ], '_WHEA_MEMORY_ERROR_SECTION_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '_RELATION_LIST_ENTRY' : [ 0x10, { @@ -1945,11 +1945,11 @@ ntkrnlmp_types = { 'PromotionCompletedEvent' : [ 0x2c0, ['_KEVENT']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], } ], '_CM_KCB_UOW' : [ 0x60, { 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -1974,16 +1974,16 @@ ntkrnlmp_types = { 'ThisVolatileKeyCell' : [ 0x58, ['unsigned long']], } ], '_MMPTE_TRANSITION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '_KREQUEST_PACKET' : [ 0x20, { 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer64', ['void']]]], @@ -1998,16 +1998,16 @@ ntkrnlmp_types = { 'CancelTimeoutTicks' : [ 0x1e, ['unsigned short']], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], } ], '__unnamed_22e0' : [ 0x8, { - 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48)]], - 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_22e2' : [ 0x8, { 's1' : [ 0x0, ['__unnamed_22e0']], @@ -2034,19 +2034,19 @@ ntkrnlmp_types = { 'Count' : [ 0x18, ['unsigned long']], } ], '_MMSECURE_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12, native_type='unsigned long')]], } ], '_PO_IRP_QUEUE' : [ 0x10, { 'CurrentIrp' : [ 0x0, ['pointer64', ['_IRP']]], 'PendingIrpList' : [ 0x8, ['pointer64', ['_IRP']]], } ], '__unnamed_22f5' : [ 0x4, { - 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'Whole' : [ 0x0, ['unsigned long']], } ], '_VI_DEADLOCK_NODE' : [ 0xd0, { @@ -2136,24 +2136,24 @@ ntkrnlmp_types = { } ], '_WHEA_ERROR_STATUS' : [ 0x8, { 'ErrorStatus' : [ 0x0, ['unsigned long long']], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], } ], '_WHEA_PERSISTENCE_INFO' : [ 0x8, { - 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40)]], - 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56)]], - 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58)]], - 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64)]], + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], 'AsULONGLONG' : [ 0x0, ['unsigned long long']], } ], '_MI_SECTION_IMAGE_INFORMATION' : [ 0x48, { @@ -2215,11 +2215,11 @@ ntkrnlmp_types = { 'Machine' : [ 0x30, ['unsigned short']], 'ImageContainsCode' : [ 0x32, ['unsigned char']], 'ImageFlags' : [ 0x33, ['unsigned char']], - 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'LoaderFlags' : [ 0x34, ['unsigned long']], 'ImageFileSize' : [ 0x38, ['unsigned long']], 'CheckSum' : [ 0x3c, ['unsigned long']], @@ -2443,10 +2443,10 @@ ntkrnlmp_types = { 'ResumeContextPages' : [ 0x120, ['unsigned long']], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'BATTERY_REPORTING_SCALE' : [ 0x8, { @@ -2472,13 +2472,13 @@ ntkrnlmp_types = { 'FileRuns' : [ 0x50, ['unsigned long']], } ], '_DEVICE_FLAGS' : [ 0x4, { - 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], } ], '_RTL_BALANCED_LINKS' : [ 0x20, { 'Parent' : [ 0x0, ['pointer64', ['_RTL_BALANCED_LINKS']]], @@ -2489,21 +2489,21 @@ ntkrnlmp_types = { } ], '_MMVIEW' : [ 0x30, { 'Entry' : [ 0x0, ['unsigned long long']], - 'Writable' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Writable' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], 'ControlArea' : [ 0x8, ['pointer64', ['_CONTROL_AREA']]], 'ViewLinks' : [ 0x10, ['_LIST_ENTRY']], 'SessionViewVa' : [ 0x20, ['pointer64', ['void']]], 'SessionId' : [ 0x28, ['unsigned long']], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_HEADLESS_LOADER_BLOCK' : [ 0x40, { 'UsedBiosSettings' : [ 0x0, ['unsigned char']], @@ -2696,19 +2696,19 @@ ntkrnlmp_types = { 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], 'SafeBootMode' : [ 0x2ec, ['unsigned char']], 'TscQpcData' : [ 0x2ed, ['unsigned char']], - 'TscQpcEnabled' : [ 0x2ed, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'TscQpcSpareFlag' : [ 0x2ed, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'TscQpcShift' : [ 0x2ed, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'TscQpcEnabled' : [ 0x2ed, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TscQpcSpareFlag' : [ 0x2ed, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'TscQpcShift' : [ 0x2ed, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], 'TscQpcPad' : [ 0x2ee, ['array', 2, ['unsigned char']]], 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], - 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], 'DataFlagsPad' : [ 0x2f4, ['array', 1, ['unsigned long']]], 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], 'SystemCall' : [ 0x300, ['unsigned long']], @@ -2759,9 +2759,9 @@ ntkrnlmp_types = { 'QuadPart' : [ 0x0, ['long long']], } ], '__unnamed_105f' : [ 0x4, { - 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1061' : [ 0x4, { 'Flags' : [ 0x0, ['unsigned long']], @@ -2877,20 +2877,20 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0x17e0, ['pointer64', ['void']]], 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16)]], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0x17f0, ['pointer64', ['void']]], 'TxnScopeExitCallback' : [ 0x17f8, ['pointer64', ['void']]], 'TxnScopeContext' : [ 0x1800, ['pointer64', ['void']]], @@ -3082,7 +3082,7 @@ ntkrnlmp_types = { 'DpcRequestSummary' : [ 0x21dc, ['long']], 'DpcRequestSlot' : [ 0x21dc, ['array', 2, ['short']]], 'NormalDpcState' : [ 0x21dc, ['short']], - 'DpcThreadActive' : [ 0x21de, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'DpcThreadActive' : [ 0x21de, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], 'ThreadDpcState' : [ 0x21de, ['short']], 'TimerHand' : [ 0x21e0, ['unsigned long']], 'MasterOffset' : [ 0x21e4, ['long']], @@ -3257,20 +3257,20 @@ ntkrnlmp_types = { 'WaitRegister' : [ 0x48, ['_KWAIT_STATUS_REGISTER']], 'Running' : [ 0x49, ['unsigned char']], 'Alerted' : [ 0x4a, ['array', 2, ['unsigned char']]], - 'KernelStackResident' : [ 0x4c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadyTransition' : [ 0x4c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessReadyQueue' : [ 0x4c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WaitNext' : [ 0x4c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemAffinityActive' : [ 0x4c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Alertable' : [ 0x4c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'GdiFlushActive' : [ 0x4c, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'UserStackWalkActive' : [ 0x4c, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ApcInterruptRequest' : [ 0x4c, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'ForceDeferSchedule' : [ 0x4c, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'QuantumEndMigrate' : [ 0x4c, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'UmsDirectedSwitchEnable' : [ 0x4c, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'TimerActive' : [ 0x4c, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Reserved' : [ 0x4c, ['BitField', dict(start_bit = 13, end_bit = 32)]], + 'KernelStackResident' : [ 0x4c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x4c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessReadyQueue' : [ 0x4c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WaitNext' : [ 0x4c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x4c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Alertable' : [ 0x4c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GdiFlushActive' : [ 0x4c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x4c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ApcInterruptRequest' : [ 0x4c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ForceDeferSchedule' : [ 0x4c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'QuantumEndMigrate' : [ 0x4c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'UmsDirectedSwitchEnable' : [ 0x4c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'TimerActive' : [ 0x4c, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Reserved' : [ 0x4c, ['BitField', dict(start_bit = 13, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x4c, ['long']], 'ApcState' : [ 0x50, ['_KAPC_STATE']], 'ApcStateFill' : [ 0x50, ['array', 43, ['unsigned char']]], @@ -3285,16 +3285,16 @@ ntkrnlmp_types = { 'Queue' : [ 0xb0, ['pointer64', ['_KQUEUE']]], 'Teb' : [ 0xb8, ['pointer64', ['void']]], 'Timer' : [ 0xc0, ['_KTIMER']], - 'AutoAlignment' : [ 0x100, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x100, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwStackTraceApc1Inserted' : [ 0x100, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EtwStackTraceApc2Inserted' : [ 0x100, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CalloutActive' : [ 0x100, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ApcQueueable' : [ 0x100, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'EnableStackSwap' : [ 0x100, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'GuiThread' : [ 0x100, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'UmsPerformingSyscall' : [ 0x100, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'ReservedFlags' : [ 0x100, ['BitField', dict(start_bit = 9, end_bit = 32)]], + 'AutoAlignment' : [ 0x100, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0x100, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'EtwStackTraceApc1Inserted' : [ 0x100, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EtwStackTraceApc2Inserted' : [ 0x100, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CalloutActive' : [ 0x100, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ApcQueueable' : [ 0x100, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0x100, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'GuiThread' : [ 0x100, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'UmsPerformingSyscall' : [ 0x100, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x100, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], 'ThreadFlags' : [ 0x100, ['long']], 'Spare0' : [ 0x104, ['unsigned long']], 'WaitBlock' : [ 0x108, ['array', 4, ['_KWAIT_BLOCK']]], @@ -3322,8 +3322,8 @@ ntkrnlmp_types = { 'ApcStateIndex' : [ 0x1f0, ['unsigned char']], 'BasePriority' : [ 0x1f1, ['unsigned char']], 'PriorityDecrement' : [ 0x1f2, ['unsigned char']], - 'ForegroundBoost' : [ 0x1f2, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'UnusualBoost' : [ 0x1f2, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ForegroundBoost' : [ 0x1f2, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'UnusualBoost' : [ 0x1f2, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'Preempted' : [ 0x1f3, ['unsigned char']], 'AdjustReason' : [ 0x1f4, ['unsigned char']], 'AdjustIncrement' : [ 0x1f5, ['unsigned char']], @@ -3393,17 +3393,17 @@ ntkrnlmp_types = { 'YieldingParam' : [ 0x78, ['pointer64', ['void']]], 'UmsTeb' : [ 0x80, ['pointer64', ['void']]], 'PrimaryFlags' : [ 0x88, ['unsigned long']], - 'UmsContextHeaderReady' : [ 0x88, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'UmsContextHeaderReady' : [ 0x88, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], 'UmsAssociatedQueue' : [ 0x20, ['pointer64', ['_KQUEUE']]], 'UmsQueueListEntry' : [ 0x28, ['pointer64', ['_LIST_ENTRY']]], 'UmsContextHeader' : [ 0x30, ['pointer64', ['_KUMS_CONTEXT_HEADER']]], 'UmsWaitGate' : [ 0x38, ['_KGATE']], 'StagingArea' : [ 0x50, ['pointer64', ['void']]], 'Flags' : [ 0x58, ['long']], - 'UmsForceQueueTermination' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'UmsAssociatedQueueUsed' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'UmsThreadParked' : [ 0x58, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'UmsPrimaryDeliveredContext' : [ 0x58, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'UmsForceQueueTermination' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'UmsAssociatedQueueUsed' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'UmsThreadParked' : [ 0x58, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'UmsPrimaryDeliveredContext' : [ 0x58, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], 'TebSelector' : [ 0x90, ['unsigned short']], } ], '_KSPIN_LOCK_QUEUE' : [ 0x10, { @@ -3421,28 +3421,28 @@ ntkrnlmp_types = { 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], } ], '__unnamed_11ca' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 25)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 64)]], - 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 61)]], - 'Region' : [ 0x8, ['BitField', dict(start_bit = 61, end_bit = 64)]], + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 25, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 61, native_type='unsigned long long')]], + 'Region' : [ 0x8, ['BitField', dict(start_bit = 61, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_11cf' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], - 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_11d2' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], - 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 4)]], - 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], } ], '_SLIST_HEADER' : [ 0x10, { 'Alignment' : [ 0x0, ['unsigned long long']], @@ -3477,11 +3477,11 @@ ntkrnlmp_types = { 'Information' : [ 0x4, ['unsigned long']], } ], '_EX_PUSH_LOCK' : [ 0x8, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], 'Ptr' : [ 0x0, ['pointer64', ['void']]], } ], @@ -3523,7 +3523,7 @@ ntkrnlmp_types = { } ], '_EX_FAST_REF' : [ 0x8, { 'Object' : [ 0x0, ['pointer64', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], } ], '_EX_PUSH_LOCK_WAIT_BLOCK' : [ 0x40, { @@ -3564,51 +3564,51 @@ ntkrnlmp_types = { 'ReadClusterSize' : [ 0x440, ['unsigned long']], 'MmLockOrdering' : [ 0x444, ['long']], 'CrossThreadFlags' : [ 0x448, ['unsigned long']], - 'Terminated' : [ 0x448, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ThreadInserted' : [ 0x448, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x448, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x448, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x448, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x448, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x448, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x448, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x448, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyTokenOnOpen' : [ 0x448, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ThreadIoPriority' : [ 0x448, ['BitField', dict(start_bit = 10, end_bit = 13)]], - 'ThreadPagePriority' : [ 0x448, ['BitField', dict(start_bit = 13, end_bit = 16)]], - 'RundownFail' : [ 0x448, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NeedsWorkingSetAging' : [ 0x448, ['BitField', dict(start_bit = 17, end_bit = 18)]], + 'Terminated' : [ 0x448, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x448, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x448, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x448, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x448, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x448, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x448, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x448, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x448, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x448, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x448, ['BitField', dict(start_bit = 10, end_bit = 13, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x448, ['BitField', dict(start_bit = 13, end_bit = 16, native_type='unsigned long')]], + 'RundownFail' : [ 0x448, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NeedsWorkingSetAging' : [ 0x448, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x44c, ['unsigned long']], - 'ActiveExWorker' : [ 0x44c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x44c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x44c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ClonedThread' : [ 0x44c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'KeyedEventInUse' : [ 0x44c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RateApcState' : [ 0x44c, ['BitField', dict(start_bit = 5, end_bit = 7)]], - 'SelfTerminate' : [ 0x44c, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveExWorker' : [ 0x44c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x44c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x44c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x44c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x44c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RateApcState' : [ 0x44c, ['BitField', dict(start_bit = 5, end_bit = 7, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x44c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x450, ['unsigned long']], - 'Spare' : [ 0x450, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'StartAddressInvalid' : [ 0x450, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwPageFaultCalloutActive' : [ 0x450, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x450, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x450, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemCacheWorkingSetExclusive' : [ 0x450, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemCacheWorkingSetShared' : [ 0x450, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x450, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x451, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsProcessAddressSpaceExclusive' : [ 0x451, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsProcessAddressSpaceShared' : [ 0x451, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SuppressSymbolLoad' : [ 0x451, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Prefetching' : [ 0x451, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsDynamicMemoryShared' : [ 0x451, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsChangeControlAreaExclusive' : [ 0x451, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsChangeControlAreaShared' : [ 0x451, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsPagedPoolWorkingSetExclusive' : [ 0x452, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsPagedPoolWorkingSetShared' : [ 0x452, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsSystemPtesWorkingSetExclusive' : [ 0x452, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsSystemPtesWorkingSetShared' : [ 0x452, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'TrimTrigger' : [ 0x452, ['BitField', dict(start_bit = 4, end_bit = 6)]], - 'Spare1' : [ 0x452, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'Spare' : [ 0x450, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x450, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EtwPageFaultCalloutActive' : [ 0x450, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x450, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x450, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetExclusive' : [ 0x450, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetShared' : [ 0x450, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x450, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x451, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceExclusive' : [ 0x451, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x451, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x451, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Prefetching' : [ 0x451, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsDynamicMemoryShared' : [ 0x451, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsChangeControlAreaExclusive' : [ 0x451, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsChangeControlAreaShared' : [ 0x451, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetExclusive' : [ 0x452, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetShared' : [ 0x452, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetExclusive' : [ 0x452, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetShared' : [ 0x452, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'TrimTrigger' : [ 0x452, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], + 'Spare1' : [ 0x452, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], 'PriorityRegionActive' : [ 0x453, ['unsigned char']], 'CacheManagerActive' : [ 0x454, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x455, ['unsigned char']], @@ -3643,7 +3643,7 @@ ntkrnlmp_types = { 'DebugPort' : [ 0x1f0, ['pointer64', ['void']]], 'ExceptionPortData' : [ 0x1f8, ['pointer64', ['void']]], 'ExceptionPortValue' : [ 0x1f8, ['unsigned long long']], - 'ExceptionPortState' : [ 0x1f8, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'ExceptionPortState' : [ 0x1f8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], 'ObjectTable' : [ 0x200, ['pointer64', ['_HANDLE_TABLE']]], 'Token' : [ 0x208, ['_EX_FAST_REF']], 'WorkingSetPage' : [ 0x210, ['unsigned long long']], @@ -3702,56 +3702,56 @@ ntkrnlmp_types = { 'HighestUserAddress' : [ 0x430, ['pointer64', ['void']]], 'ModifiedPageCount' : [ 0x438, ['unsigned long']], 'Flags2' : [ 0x43c, ['unsigned long']], - 'JobNotReallyActive' : [ 0x43c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AccountingFolded' : [ 0x43c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'NewProcessReported' : [ 0x43c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ExitProcessReported' : [ 0x43c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReportCommitChanges' : [ 0x43c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LastReportMemory' : [ 0x43c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ReportPhysicalPageChanges' : [ 0x43c, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'HandleTableRundown' : [ 0x43c, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'NeedsHandleRundown' : [ 0x43c, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RefTraceEnabled' : [ 0x43c, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'NumaAware' : [ 0x43c, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtectedProcess' : [ 0x43c, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'DefaultPagePriority' : [ 0x43c, ['BitField', dict(start_bit = 12, end_bit = 15)]], - 'PrimaryTokenFrozen' : [ 0x43c, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessVerifierTarget' : [ 0x43c, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'StackRandomizationDisabled' : [ 0x43c, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'AffinityPermanent' : [ 0x43c, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'AffinityUpdateEnable' : [ 0x43c, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'PropagateNode' : [ 0x43c, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'ExplicitAffinity' : [ 0x43c, ['BitField', dict(start_bit = 21, end_bit = 22)]], + 'JobNotReallyActive' : [ 0x43c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x43c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x43c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x43c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x43c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x43c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ReportPhysicalPageChanges' : [ 0x43c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'HandleTableRundown' : [ 0x43c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x43c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x43c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'NumaAware' : [ 0x43c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtectedProcess' : [ 0x43c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x43c, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x43c, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x43c, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x43c, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x43c, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x43c, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PropagateNode' : [ 0x43c, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'ExplicitAffinity' : [ 0x43c, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], 'Flags' : [ 0x440, ['unsigned long']], - 'CreateReported' : [ 0x440, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x440, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x440, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x440, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x440, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x440, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x440, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x440, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x440, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x440, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x440, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x440, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x440, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'DeprioritizeViews' : [ 0x440, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x440, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x440, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x440, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x440, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x440, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x440, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x440, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x440, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x440, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x440, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'CrossSessionCreate' : [ 0x440, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'ProcessInserted' : [ 0x440, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x440, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'ProcessSelfDelete' : [ 0x440, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'SetTimerResolutionLink' : [ 0x440, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x440, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x440, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x440, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x440, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x440, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x440, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x440, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x440, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x440, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x440, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x440, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x440, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x440, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x440, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x440, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x440, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x440, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x440, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x440, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x440, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x440, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x440, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x440, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x440, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x440, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x440, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x440, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x440, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SetTimerResolutionLink' : [ 0x440, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x444, ['long']], 'VadRoot' : [ 0x448, ['_MM_AVL_TABLE']], 'AlpcContext' : [ 0x488, ['_ALPC_PROCESS_CONTEXT']], @@ -3771,11 +3771,11 @@ ntkrnlmp_types = { 'ReadyListHead' : [ 0x70, ['_LIST_ENTRY']], 'SwapListEntry' : [ 0x80, ['_SINGLE_LIST_ENTRY']], 'ActiveProcessors' : [ 0x88, ['_KAFFINITY_EX']], - 'AutoAlignment' : [ 0xb0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xb0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0xb0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveGroupsMask' : [ 0xb0, ['BitField', dict(start_bit = 3, end_bit = 7)]], - 'ReservedFlags' : [ 0xb0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'AutoAlignment' : [ 0xb0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0xb0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0xb0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ActiveGroupsMask' : [ 0xb0, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xb0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='long')]], 'ProcessFlags' : [ 0xb0, ['long']], 'BasePriority' : [ 0xb4, ['unsigned char']], 'QuantumReset' : [ 0xb5, ['unsigned char']], @@ -4285,8 +4285,8 @@ ntkrnlmp_types = { 'Flags' : [ 0x4, ['unsigned char']], 'IsFastIoPossible' : [ 0x5, ['unsigned char']], 'Flags2' : [ 0x6, ['unsigned char']], - 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'Resource' : [ 0x8, ['pointer64', ['_ERESOURCE']]], 'PagingIoResource' : [ 0x10, ['pointer64', ['_ERESOURCE']]], 'AllocationSize' : [ 0x18, ['_LARGE_INTEGER']], @@ -4389,12 +4389,12 @@ ntkrnlmp_types = { 'e2' : [ 0x0, ['__unnamed_1532']], } ], '__unnamed_153c' : [ 0x8, { - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 52)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55)]], - 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 52, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57, native_type='unsigned long long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58, native_type='unsigned long long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64, native_type='unsigned long long')]], } ], '_MMPFN' : [ 0x30, { 'u1' : [ 0x0, ['__unnamed_152d']], @@ -4483,10 +4483,10 @@ ntkrnlmp_types = { 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], 'WritableUserReferences' : [ 0x4, ['long']], - 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30)]], - 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30, native_type='unsigned long')]], + 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubsectionRoot' : [ 0x8, ['pointer64', ['_MM_SUBSECTION_AVL_TABLE']]], 'SeImageStub' : [ 0x8, ['pointer64', ['_MI_IMAGE_SECURITY_REFERENCE']]], } ], @@ -4512,8 +4512,8 @@ ntkrnlmp_types = { 'ViewList' : [ 0x70, ['_LIST_ENTRY']], } ], '_MM_STORE_KEY' : [ 0x8, { - 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 60)]], - 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 64)]], + 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 60, native_type='unsigned long long')]], + 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 64, native_type='unsigned long long')]], 'EntireKey' : [ 0x0, ['unsigned long long']], } ], '_MMPAGING_FILE' : [ 0x90, { @@ -4531,25 +4531,25 @@ ntkrnlmp_types = { 'BitmapHint' : [ 0x68, ['unsigned long']], 'LastAllocationSize' : [ 0x6c, ['unsigned long']], 'ToBeEvictedCount' : [ 0x70, ['unsigned long']], - 'PageFileNumber' : [ 0x74, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'BootPartition' : [ 0x74, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Spare0' : [ 0x74, ['BitField', dict(start_bit = 5, end_bit = 16)]], - 'AdriftMdls' : [ 0x76, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare1' : [ 0x76, ['BitField', dict(start_bit = 1, end_bit = 16)]], + 'PageFileNumber' : [ 0x74, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'BootPartition' : [ 0x74, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Spare0' : [ 0x74, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x76, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare1' : [ 0x76, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], 'FileHandle' : [ 0x78, ['pointer64', ['void']]], 'Lock' : [ 0x80, ['unsigned long long']], 'LockOwner' : [ 0x88, ['pointer64', ['_ETHREAD']]], } ], '_MM_AVL_TABLE' : [ 0x40, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'NodeHint' : [ 0x30, ['pointer64', ['void']]], 'NodeFreeHint' : [ 0x38, ['pointer64', ['void']]], } ], '__unnamed_15be' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMVAD']]], } ], '__unnamed_15c1' : [ 0x8, { @@ -4571,7 +4571,7 @@ ntkrnlmp_types = { 'u5' : [ 0x38, ['__unnamed_15c4']], } ], '__unnamed_15cc' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x28, { @@ -4755,16 +4755,16 @@ ntkrnlmp_types = { } ], '_CM_KEY_CONTROL_BLOCK' : [ 0x128, { 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31)]], - 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31, native_type='unsigned long')]], + 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'KeyHash' : [ 0x10, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x10, ['unsigned long']], 'NextHash' : [ 0x18, ['pointer64', ['_CM_KEY_HASH']]], @@ -4788,10 +4788,10 @@ ntkrnlmp_types = { 'KcbMaxNameLen' : [ 0xb0, ['unsigned short']], 'KcbMaxValueNameLen' : [ 0xb2, ['unsigned short']], 'KcbMaxValueDataLen' : [ 0xb4, ['unsigned long']], - 'KcbUserFlags' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'KcbVirtControlFlags' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'KcbDebug' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Flags' : [ 0xb8, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'KcbUserFlags' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0xb8, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'RealKeyName' : [ 0xc0, ['pointer64', ['unsigned char']]], 'KCBUoWListHead' : [ 0xc8, ['_LIST_ENTRY']], 'DelayQueueEntry' : [ 0xd8, ['_LIST_ENTRY']], @@ -5674,12 +5674,12 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['pointer64', ['void']]], 'ImageBaseAddress' : [ 0x10, ['pointer64', ['void']]], 'Ldr' : [ 0x18, ['pointer64', ['_PEB_LDR_DATA']]], @@ -5690,12 +5690,12 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x40, ['pointer64', ['void']]], 'IFEOKey' : [ 0x48, ['pointer64', ['void']]], 'CrossProcessFlags' : [ 0x50, ['unsigned long']], - 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32)]], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x58, ['pointer64', ['void']]], 'UserSharedInfoPtr' : [ 0x58, ['pointer64', ['void']]], 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], @@ -5758,9 +5758,9 @@ ntkrnlmp_types = { 'pContextData' : [ 0x368, ['pointer64', ['void']]], 'pImageHeaderHash' : [ 0x370, ['pointer64', ['void']]], 'TracingFlags' : [ 0x378, ['unsigned long']], - 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_PEB_LDR_DATA' : [ 0x58, { 'Length' : [ 0x0, ['unsigned long']], @@ -5856,10 +5856,10 @@ ntkrnlmp_types = { 'LookasideIndex' : [ 0x30, ['unsigned long']], } ], '__unnamed_199c' : [ 0x1, { - 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], } ], '__unnamed_199e' : [ 0x1, { 's1' : [ 0x0, ['__unnamed_199c']], @@ -5875,8 +5875,8 @@ ntkrnlmp_types = { 'Lock' : [ 0x18, ['_EX_PUSH_LOCK']], } ], '__unnamed_19b1' : [ 0x4, { - 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_19b3' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19b1']], @@ -5893,7 +5893,7 @@ ntkrnlmp_types = { 'RegionListHead' : [ 0x38, ['_LIST_ENTRY']], } ], '__unnamed_19b9' : [ 0x4, { - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], } ], '__unnamed_19bb' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19b9']], @@ -5911,9 +5911,9 @@ ntkrnlmp_types = { 'ReadWriteView' : [ 0x50, ['pointer64', ['_KALPC_VIEW']]], } ], '__unnamed_19c1' : [ 0x4, { - 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], } ], '__unnamed_19c3' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19c1']], @@ -5939,22 +5939,22 @@ ntkrnlmp_types = { 'HandleTable' : [ 0x28, ['_ALPC_HANDLE_TABLE']], } ], '__unnamed_19df' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], } ], '__unnamed_19e1' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19df']], @@ -6019,18 +6019,18 @@ ntkrnlmp_types = { 'CallbackId' : [ 0x14, ['unsigned long']], } ], '__unnamed_19fe' : [ 0x4, { - 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], } ], '__unnamed_1a00' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19fe']], @@ -6087,8 +6087,8 @@ ntkrnlmp_types = { 'HandleData' : [ 0x30, ['pointer64', ['_KALPC_HANDLE_DATA']]], } ], '__unnamed_1a3f' : [ 0x4, { - 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_1a41' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1a3f']], @@ -6280,23 +6280,23 @@ ntkrnlmp_types = { 'SecurityDescriptor' : [ 0x300, ['_EX_FAST_REF']], 'BufferSequenceNumber' : [ 0x308, ['long long']], 'Flags' : [ 0x310, ['unsigned long']], - 'Persistent' : [ 0x310, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoLogger' : [ 0x310, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'FsReady' : [ 0x310, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RealTime' : [ 0x310, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow' : [ 0x310, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelTrace' : [ 0x310, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'NoMoreEnable' : [ 0x310, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'StackTracing' : [ 0x310, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ErrorLogged' : [ 0x310, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RealtimeLoggerContextFreed' : [ 0x310, ['BitField', dict(start_bit = 9, end_bit = 10)]], + 'Persistent' : [ 0x310, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x310, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x310, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x310, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x310, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x310, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x310, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'StackTracing' : [ 0x310, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ErrorLogged' : [ 0x310, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RealtimeLoggerContextFreed' : [ 0x310, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], 'RequestFlag' : [ 0x314, ['unsigned long']], - 'RequestNewFie' : [ 0x314, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'RequestUpdateFile' : [ 0x314, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'RequestFlush' : [ 0x314, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RequestDisableRealtime' : [ 0x314, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RequestDisconnectConsumer' : [ 0x314, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RequestConnectConsumer' : [ 0x314, ['BitField', dict(start_bit = 5, end_bit = 6)]], + 'RequestNewFie' : [ 0x314, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RequestUpdateFile' : [ 0x314, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'RequestFlush' : [ 0x314, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RequestDisableRealtime' : [ 0x314, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequestDisconnectConsumer' : [ 0x314, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RequestConnectConsumer' : [ 0x314, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], 'HookIdMap' : [ 0x318, ['_RTL_BITMAP']], } ], '_ETW_LOGGER_HANDLE' : [ 0x1, { @@ -6346,8 +6346,8 @@ ntkrnlmp_types = { 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], 'LoggerId' : [ 0x8, ['unsigned short']], 'Level' : [ 0xa, ['unsigned char']], - 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_TRACE_ENABLE_CONTEXT' : [ 0x8, { 'LoggerId' : [ 0x0, ['unsigned short']], @@ -6495,8 +6495,8 @@ ntkrnlmp_types = { '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x8, { 'ImpersonationData' : [ 0x0, ['unsigned long long']], 'ImpersonationToken' : [ 0x0, ['pointer64', ['void']]], - 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], } ], '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], @@ -6507,14 +6507,14 @@ ntkrnlmp_types = { 'PpcControlSet' : [ 0x0, ['_PPC_DBGKD_CONTROL_SET']], } ], '_MMVAD_FLAGS3' : [ 0x8, { - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6)]], - 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24)]], - 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'LargePageCreating' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33)]], - 'Spare3' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64)]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned long long')]], + 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24, native_type='unsigned long long')]], + 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long long')]], + 'LargePageCreating' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'Spare3' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64, native_type='unsigned long long')]], } ], '_MI_VERIFIER_POOL_HEADER' : [ 0x8, { 'VerifierPoolEntry' : [ 0x0, ['pointer64', ['_VI_POOL_ENTRY']]], @@ -6578,22 +6578,22 @@ ntkrnlmp_types = { 'Request' : [ 0x28, ['_PORT_MESSAGE']], } ], '_HARDWARE_PTE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 40, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_DUAL' : [ 0x278, { 'Length' : [ 0x0, ['unsigned long']], @@ -6629,35 +6629,35 @@ ntkrnlmp_types = { } ], '_KSTACK_COUNT' : [ 0x4, { 'Value' : [ 0x0, ['long']], - 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], } ], '_DISPATCHER_HEADER' : [ 0x18, { 'Type' : [ 0x0, ['unsigned char']], 'TimerControlFlags' : [ 0x1, ['unsigned char']], - 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Coalescable' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'KeepShifting' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Coalescable' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KeepShifting' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], 'Abandoned' : [ 0x1, ['unsigned char']], 'Signalling' : [ 0x1, ['unsigned char']], 'ThreadControlFlags' : [ 0x2, ['unsigned char']], - 'CpuThrottled' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'CpuThrottled' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], 'Hand' : [ 0x2, ['unsigned char']], 'Size' : [ 0x2, ['unsigned char']], 'TimerMiscFlags' : [ 0x3, ['unsigned char']], - 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 6)]], - 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned char')]], + 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], 'DebugActive' : [ 0x3, ['unsigned char']], - 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved2' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved2' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned char')]], + 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], 'DpcActive' : [ 0x3, ['unsigned char']], 'Lock' : [ 0x0, ['long']], 'SignalState' : [ 0x4, ['long']], @@ -6786,7 +6786,7 @@ ntkrnlmp_types = { 'DebugInfo' : [ 0x38, ['pointer64', ['_HANDLE_TRACE_DEBUG_INFO']]], 'ExtraInfoPages' : [ 0x40, ['long']], 'Flags' : [ 0x44, ['unsigned long']], - 'StrictFIFO' : [ 0x44, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x44, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], 'FirstFreeHandle' : [ 0x48, ['unsigned long']], 'LastFreeHandleEntry' : [ 0x50, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], 'HandleCount' : [ 0x58, ['unsigned long']], @@ -6800,15 +6800,15 @@ ntkrnlmp_types = { 'NumberOfBytes' : [ 0x10, ['unsigned long long']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_TEB_ACTIVE_FRAME' : [ 0x18, { 'Flags' : [ 0x0, ['unsigned long']], @@ -6829,8 +6829,8 @@ ntkrnlmp_types = { 'NotifyBlock' : [ 0x10, ['pointer64', ['_CM_NOTIFY_BLOCK']]], 'ProcessID' : [ 0x18, ['pointer64', ['void']]], 'KeyBodyList' : [ 0x20, ['_LIST_ENTRY']], - 'Flags' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'HandleTags' : [ 0x30, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'Flags' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'HandleTags' : [ 0x30, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'KtmTrans' : [ 0x38, ['pointer64', ['void']]], 'KtmUow' : [ 0x40, ['pointer64', ['_GUID']]], 'ContextListHead' : [ 0x48, ['_LIST_ENTRY']], @@ -6846,22 +6846,22 @@ ntkrnlmp_types = { 'SpareLong' : [ 0x2c, ['long']], } ], '_MMPTE_PROTOTYPE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_THERMAL_INFORMATION_EX' : [ 0x78, { @@ -6878,15 +6878,15 @@ ntkrnlmp_types = { 'S4TransitionTripPoint' : [ 0x74, ['unsigned long']], } ], '__unnamed_1c5a' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], } ], '__unnamed_1c5c' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], } ], '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { 'File' : [ 0x0, ['__unnamed_1c5a']], @@ -6898,14 +6898,14 @@ ntkrnlmp_types = { 'Parameters' : [ 0x10, ['array', 2, ['unsigned long long']]], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16)]], - 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16)]], + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], } ], '_EXCEPTION_POINTERS' : [ 0x10, { 'ExceptionRecord' : [ 0x0, ['pointer64', ['_EXCEPTION_RECORD']]], @@ -6973,9 +6973,9 @@ ntkrnlmp_types = { 'u4' : [ 0x88, ['__unnamed_1c83']], } ], '_MMWSLE_FREE_ENTRY' : [ 0x8, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], - 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_NT_TIB' : [ 0x38, { 'ExceptionList' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], @@ -7038,10 +7038,10 @@ ntkrnlmp_types = { } ], '__unnamed_1c97' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_IDLE_STATES' : [ 0xa0, { 'Count' : [ 0x0, ['unsigned long']], @@ -7058,8 +7058,8 @@ ntkrnlmp_types = { 'PcatInformation' : [ 0x0, ['_PCAT_FIRMWARE_INFORMATION']], } ], '_FIRMWARE_INFORMATION_LOADER_BLOCK' : [ 0x20, { - 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'u' : [ 0x8, ['__unnamed_1ca0']], } ], '_HEAP_UCR_DESCRIPTOR' : [ 0x30, { @@ -7150,9 +7150,9 @@ ntkrnlmp_types = { 'PostList' : [ 0x10, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x20, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x28, ['pointer64', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x38, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_KINTERRUPT' : [ 0xa0, { @@ -7310,22 +7310,22 @@ ntkrnlmp_types = { 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], } ], '_MMPTE_HARDWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x10, { 'Port' : [ 0x0, ['pointer64', ['void']]], @@ -7448,13 +7448,13 @@ ntkrnlmp_types = { 'List' : [ 0x4, ['unsigned long']], } ], '_MMVAD_FLAGS' : [ 0x8, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51, native_type='unsigned long long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63, native_type='unsigned long long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_MMWSLE_HASH' : [ 0x4, { 'Index' : [ 0x0, ['unsigned long']], @@ -7493,10 +7493,10 @@ ntkrnlmp_types = { } ], '_VF_TRACKER_STAMP' : [ 0x10, { 'Thread' : [ 0x0, ['pointer64', ['void']]], - 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], } ], '_VI_TRACK_IRQL' : [ 0x38, { 'Thread' : [ 0x0, ['pointer64', ['void']]], @@ -7540,7 +7540,7 @@ ntkrnlmp_types = { '_XSTATE_CONFIGURATION' : [ 0x210, { 'EnabledFeatures' : [ 0x0, ['unsigned long long']], 'Size' : [ 0x8, ['unsigned long']], - 'OptimizedSave' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'OptimizedSave' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], 'Features' : [ 0x10, ['array', 64, ['_XSTATE_FEATURE']]], } ], '_CM_KEY_SECURITY_CACHE' : [ 0x38, { @@ -7552,36 +7552,36 @@ ntkrnlmp_types = { 'Descriptor' : [ 0x20, ['_SECURITY_DESCRIPTOR_RELATIVE']], } ], '_MMPTE_SOFTWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22)]], - 'InStore' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 32)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22, native_type='unsigned long long')]], + 'InStore' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_RTL_UMS_CONTEXT' : [ 0x540, { 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], 'Context' : [ 0x10, ['_CONTEXT']], 'Teb' : [ 0x4e0, ['pointer64', ['void']]], 'UserContext' : [ 0x4e8, ['pointer64', ['void']]], - 'ScheduledThread' : [ 0x4f0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'HasQuantumReq' : [ 0x4f0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasAffinityReq' : [ 0x4f0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'HasPriorityReq' : [ 0x4f0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Suspended' : [ 0x4f0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VolatileContext' : [ 0x4f0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Terminated' : [ 0x4f0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DebugActive' : [ 0x4f0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'DenyRunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ReservedFlags' : [ 0x4f0, ['BitField', dict(start_bit = 10, end_bit = 32)]], + 'ScheduledThread' : [ 0x4f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'HasQuantumReq' : [ 0x4f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HasAffinityReq' : [ 0x4f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'HasPriorityReq' : [ 0x4f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Suspended' : [ 0x4f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VolatileContext' : [ 0x4f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Terminated' : [ 0x4f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DebugActive' : [ 0x4f0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DenyRunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x4f0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], 'Flags' : [ 0x4f0, ['long']], - 'KernelUpdateLock' : [ 0x4f8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x4f8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PrimaryClientID' : [ 0x4f8, ['BitField', dict(start_bit = 2, end_bit = 64)]], + 'KernelUpdateLock' : [ 0x4f8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x4f8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PrimaryClientID' : [ 0x4f8, ['BitField', dict(start_bit = 2, end_bit = 64, native_type='unsigned long long')]], 'ContextLock' : [ 0x4f8, ['unsigned long long']], 'QuantumValue' : [ 0x500, ['unsigned long long']], 'AffinityMask' : [ 0x508, ['_GROUP_AFFINITY']], @@ -7607,9 +7607,9 @@ ntkrnlmp_types = { } ], '_MM_SUBSECTION_AVL_TABLE' : [ 0x38, { 'BalancedRoot' : [ 0x0, ['_MMSUBSECTION_NODE']], - 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'NodeHint' : [ 0x30, ['pointer64', ['void']]], } ], '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { @@ -7621,13 +7621,13 @@ ntkrnlmp_types = { 'PartialResourceList' : [ 0x8, ['_CM_PARTIAL_RESOURCE_LIST']], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { - 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_WMI_BUFFER_HEADER' : [ 0x48, { @@ -7697,17 +7697,17 @@ ntkrnlmp_types = { 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], - 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEGMENT_OBJECT' : [ 0x40, { 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], @@ -7751,21 +7751,21 @@ ntkrnlmp_types = { 'DataLength' : [ 0x10, ['unsigned long']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], } ], '_IMAGE_OPTIONAL_HEADER64' : [ 0xf0, { 'Magic' : [ 0x0, ['unsigned short']], @@ -7937,20 +7937,20 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16)]], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], @@ -8013,9 +8013,9 @@ ntkrnlmp_types = { } ], '_OWNER_ENTRY' : [ 0x10, { 'OwnerThread' : [ 0x0, ['unsigned long long']], - 'IoPriorityBoosted' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnerReferenced' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnerCount' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'IoPriorityBoosted' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OwnerReferenced' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OwnerCount' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'TableSize' : [ 0x8, ['unsigned long']], } ], '_MI_SECTION_CREATION_GATE' : [ 0x20, { @@ -8143,26 +8143,26 @@ ntkrnlmp_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -8272,14 +8272,14 @@ ntkrnlmp_types = { 'Metrics' : [ 0x150, ['_POP_THERMAL_ZONE_METRICS']], } ], '_MMPTE_LIST' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_VI_POOL_PAGE_HEADER' : [ 0x18, { 'NextPage' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], @@ -8325,10 +8325,10 @@ ntkrnlmp_types = { 'HiveArray' : [ 0x70, ['array', 7, ['pointer64', ['_CMHIVE']]]], } ], '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { - 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x1c, { @@ -8383,8 +8383,8 @@ ntkrnlmp_types = { 'PolicySetStatus' : [ 0x1b, ['unsigned char']], } ], '__unnamed_1ec3' : [ 0x4, { - 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1ec5' : [ 0x18, { 'AllSharedExportThunks' : [ 0x0, ['_VF_TARGET_ALL_SHARED_EXPORT_THUNKS']], @@ -8462,13 +8462,13 @@ ntkrnlmp_types = { 'BaseName' : [ 0x18, ['_UNICODE_STRING']], } ], '_MMPTE_TIMESTAMP' : [ 0x8, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], - 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_SID_AND_ATTRIBUTES_HASH' : [ 0x110, { 'SidCount' : [ 0x0, ['unsigned long']], @@ -8518,8 +8518,8 @@ ntkrnlmp_types = { 'SessionId' : [ 0x10, ['unsigned long']], 'CpuShareWeight' : [ 0x14, ['unsigned long']], 'CapturedWeightData' : [ 0x18, ['_PSP_CPU_SHARE_CAPTURED_WEIGHT_DATA']], - 'DuplicateInputMarker' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'DuplicateInputMarker' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x20, ['long']], 'BlockCurrentGenerationLock' : [ 0x0, ['unsigned long long']], 'CyclesAccumulated' : [ 0x8, ['unsigned long long']], @@ -8531,10 +8531,10 @@ ntkrnlmp_types = { } ], '__unnamed_1efd' : [ 0x1, { 'AsUCHAR' : [ 0x0, ['unsigned char']], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], } ], 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { 'Revision' : [ 0x0, ['unsigned long']], @@ -8564,29 +8564,29 @@ ntkrnlmp_types = { 'DeviceListHead' : [ 0x8, ['_LIST_ENTRY']], 'Lock' : [ 0x18, ['unsigned long long']], 'Busy' : [ 0x20, ['unsigned char']], - 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='long long')]], + 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='long long')]], } ], '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'ContextAsUlong' : [ 0x0, ['unsigned long']], } ], '_OBJECT_TYPE_INITIALIZER' : [ 0x70, { 'Length' : [ 0x0, ['unsigned short']], 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], - 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], 'ObjectTypeCode' : [ 0x4, ['unsigned long']], 'InvalidAttributes' : [ 0x8, ['unsigned long']], 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], @@ -8651,14 +8651,14 @@ ntkrnlmp_types = { 'ActualLimit' : [ 0x20, ['unsigned long long']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], 'ExecuteOptions' : [ 0x0, ['unsigned char']], } ], '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { @@ -8692,13 +8692,13 @@ ntkrnlmp_types = { 'Reserved' : [ 0xc, ['unsigned long']], } ], '_MMWSLENTRY' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], } ], '_DBGKD_SWITCH_PARTITION' : [ 0x4, { 'Partition' : [ 0x0, ['unsigned long']], @@ -8732,15 +8732,15 @@ ntkrnlmp_types = { 'Exchg' : [ 0x0, ['long long']], } ], '_WHEA_TIMESTAMP' : [ 0x8, { - 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32)]], - 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40)]], - 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48)]], - 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56)]], - 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64)]], + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], } ], '_PEB32' : [ 0x248, { @@ -8748,12 +8748,12 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['unsigned long']], 'ImageBaseAddress' : [ 0x8, ['unsigned long']], 'Ldr' : [ 0xc, ['unsigned long']], @@ -8764,12 +8764,12 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x20, ['unsigned long']], 'IFEOKey' : [ 0x24, ['unsigned long']], 'CrossProcessFlags' : [ 0x28, ['unsigned long']], - 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32)]], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x2c, ['unsigned long']], 'UserSharedInfoPtr' : [ 0x2c, ['unsigned long']], 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], @@ -8832,9 +8832,9 @@ ntkrnlmp_types = { 'pContextData' : [ 0x238, ['unsigned long']], 'pImageHeaderHash' : [ 0x23c, ['unsigned long']], 'TracingFlags' : [ 0x240, ['unsigned long']], - 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_VPB' : [ 0x60, { 'Type' : [ 0x0, ['short']], @@ -8868,9 +8868,9 @@ ntkrnlmp_types = { 'ProcessAuditId' : [ 0x18, ['pointer64', ['void']]], } ], '_KBUGCHECK_ACTIVE_STATE' : [ 0x4, { - 'BugCheckState' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'RecursionCount' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'BugCheckOwner' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'BugCheckState' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'RecursionCount' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'BugCheckOwner' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['long']], } ], '_PF_KERNEL_GLOBALS' : [ 0x60, { @@ -8925,12 +8925,12 @@ ntkrnlmp_types = { 'HandleAttributes' : [ 0x20, ['unsigned long']], } ], '_MMPTE_SUBSECTION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_POWER_STATE' : [ 0x4, { 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], @@ -9047,7 +9047,7 @@ ntkrnlmp_types = { 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], } ], '__unnamed_1fd4' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMSUBSECTION_NODE']]], } ], '_MMSUBSECTION_NODE' : [ 0x28, { @@ -9090,9 +9090,9 @@ ntkrnlmp_types = { 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { - 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], 'AsUCHAR' : [ 0x0, ['unsigned char']], } ], '_FS_FILTER_CALLBACKS' : [ 0x68, { diff --git a/volatility/plugins/overlays/windows/win7_sp0_x86_vtypes.py b/volatility/plugins/overlays/windows/win7_sp0_x86_vtypes.py index fe959325..e70d028d 100644 --- a/volatility/plugins/overlays/windows/win7_sp0_x86_vtypes.py +++ b/volatility/plugins/overlays/windows/win7_sp0_x86_vtypes.py @@ -1,4 +1,4 @@ -nt_types = { +ntkrnlmp_types = { '_u' : [ 0x50, { 'KeyNode' : [ 0x0, ['_CM_KEY_NODE']], 'KeyValue' : [ 0x0, ['_CM_KEY_VALUE']], @@ -38,9 +38,9 @@ nt_types = { } ], '__unnamed_2008' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_PERF_STATES' : [ 0x80, { 'Count' : [ 0x0, ['unsigned long']], @@ -188,10 +188,10 @@ nt_types = { '_IMAGE_SECURITY_CONTEXT' : [ 0x4, { 'PageHashes' : [ 0x0, ['pointer', ['void']]], 'Value' : [ 0x0, ['unsigned long']], - 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_204b' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], @@ -266,10 +266,10 @@ nt_types = { 'FirmwareDescriptorListHead' : [ 0x40, ['_LIST_ENTRY']], 'AcpiTable' : [ 0x48, ['pointer', ['void']]], 'AcpiTableSize' : [ 0x4c, ['unsigned long']], - 'LastBootSucceeded' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LastBootShutdown' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IoPortAccessSupported' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'LastBootSucceeded' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LastBootShutdown' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoPortAccessSupported' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'LoaderPerformanceData' : [ 0x54, ['pointer', ['_LOADER_PERFORMANCE_DATA']]], 'BootApplicationPersistentData' : [ 0x58, ['_LIST_ENTRY']], 'WmdTestResult' : [ 0x60, ['pointer', ['void']]], @@ -343,11 +343,11 @@ nt_types = { 'PageCount' : [ 0x4, ['unsigned long']], } ], '_RTL_SRWLOCK' : [ 0x4, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -417,10 +417,10 @@ nt_types = { 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], } ], '_POOL_HEADER' : [ 0x8, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16)]], - 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'AllocatorBackTraceIndex' : [ 0x4, ['unsigned short']], @@ -499,8 +499,8 @@ nt_types = { } ], '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x8, { 'Process' : [ 0x0, ['pointer', ['_EPROCESS']]], - 'HandleCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'LockCount' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'HandleCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_CLIENT_ID' : [ 0x8, { 'UniqueProcess' : [ 0x0, ['pointer', ['void']]], @@ -526,18 +526,18 @@ nt_types = { } ], '_KWAIT_STATUS_REGISTER' : [ 0x1, { 'Flags' : [ 0x0, ['unsigned char']], - 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Priority' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Apc' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Alert' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Apc' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Alert' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_VI_DEADLOCK_RESOURCE' : [ 0x80, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockInStackQueuedSpinLock', 7: 'VfDeadlockUnusedSpinLock', 8: 'VfDeadlockEresource', 9: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer', ['void']]], 'ThreadOwner' : [ 0xc, ['pointer', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x10, ['_LIST_ENTRY']], @@ -555,33 +555,33 @@ nt_types = { 'Length' : [ 0x10, ['unsigned long']], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], } ], '_SECURITY_CLIENT_CONTEXT' : [ 0x3c, { 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], @@ -799,9 +799,9 @@ nt_types = { } ], '__unnamed_2179' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { 'Revision' : [ 0x0, ['unsigned short']], @@ -920,8 +920,8 @@ nt_types = { 'ReasonSize' : [ 0xc, ['unsigned long']], } ], '__unnamed_219c' : [ 0x4, { - 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_219e' : [ 0x4, { 'Flags' : [ 0x0, ['__unnamed_219c']], @@ -994,10 +994,10 @@ nt_types = { 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], 'Security' : [ 0x2c, ['unsigned long']], 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'MaxClassLen' : [ 0x38, ['unsigned long']], 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], 'MaxValueDataLen' : [ 0x40, ['unsigned long']], @@ -1032,10 +1032,10 @@ nt_types = { 'Offset' : [ 0x18, ['unsigned long']], 'Length' : [ 0x1c, ['unsigned long']], 'Page' : [ 0x20, ['unsigned long']], - 'IoMapping' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Matched' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CacheAttribute' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'Spare' : [ 0x24, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'IoMapping' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Spare' : [ 0x24, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'CallingAddress' : [ 0x28, ['pointer', ['void']]], 'CallersCaller' : [ 0x2c, ['pointer', ['void']]], } ], @@ -1184,18 +1184,18 @@ nt_types = { 'TimeRefreshLockAcquired' : [ 0x1a4, ['unsigned char']], } ], '_SEGMENT_FLAGS' : [ 0x4, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22)]], - 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'ContainsDebug' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22, native_type='unsigned long')]], + 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'ContainsDebug' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_VF_KE_CRITICAL_REGION_TRACE' : [ 0x20, { 'Thread' : [ 0x0, ['pointer', ['_ETHREAD']]], @@ -1304,22 +1304,22 @@ nt_types = { 'FileAttributes' : [ 0x30, ['unsigned long']], } ], '_WHEA_MEMORY_ERROR_SECTION_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '_RELATION_LIST_ENTRY' : [ 0xc, { @@ -1413,9 +1413,9 @@ nt_types = { '_VF_BTS_RECORD' : [ 0xc, { 'JumpedFrom' : [ 0x0, ['pointer', ['void']]], 'JumpedTo' : [ 0x4, ['pointer', ['void']]], - 'Unused1' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Predicted' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 7)]], - 'Unused2' : [ 0x8, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Unused1' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Predicted' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'Unused2' : [ 0x8, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_KTRANSACTION' : [ 0x1e0, { 'OutcomeEvent' : [ 0x0, ['_KEVENT']], @@ -1461,11 +1461,11 @@ nt_types = { 'PromotionCompletedEvent' : [ 0x1cc, ['_KEVENT']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], } ], '_CM_KCB_UOW' : [ 0x38, { 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -1494,15 +1494,15 @@ nt_types = { 'SpecialRegisters' : [ 0x2cc, ['_KSPECIAL_REGISTERS']], } ], '_MMPTE_TRANSITION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_VF_WATCHDOG_IRP' : [ 0x14, { 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -1513,16 +1513,16 @@ nt_types = { 'CancelTimeoutTicks' : [ 0x12, ['unsigned short']], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], } ], '__unnamed_2270' : [ 0x8, { - 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48)]], - 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_2272' : [ 0x8, { 's1' : [ 0x0, ['__unnamed_2270']], @@ -1549,19 +1549,19 @@ nt_types = { 'Count' : [ 0x18, ['unsigned long']], } ], '_MMSECURE_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12, native_type='unsigned long')]], } ], '_PO_IRP_QUEUE' : [ 0x8, { 'CurrentIrp' : [ 0x0, ['pointer', ['_IRP']]], 'PendingIrpList' : [ 0x4, ['pointer', ['_IRP']]], } ], '__unnamed_2285' : [ 0x4, { - 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'Whole' : [ 0x0, ['unsigned long']], } ], '_VI_DEADLOCK_NODE' : [ 0x6c, { @@ -1651,24 +1651,24 @@ nt_types = { } ], '_WHEA_ERROR_STATUS' : [ 0x8, { 'ErrorStatus' : [ 0x0, ['unsigned long long']], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], } ], '_WHEA_PERSISTENCE_INFO' : [ 0x8, { - 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40)]], - 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56)]], - 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58)]], - 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64)]], + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], 'AsULONGLONG' : [ 0x0, ['unsigned long long']], } ], '_MI_SECTION_IMAGE_INFORMATION' : [ 0x38, { @@ -1725,11 +1725,11 @@ nt_types = { 'Machine' : [ 0x20, ['unsigned short']], 'ImageContainsCode' : [ 0x22, ['unsigned char']], 'ImageFlags' : [ 0x23, ['unsigned char']], - 'ComPlusNativeReady' : [ 0x23, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ComPlusILOnly' : [ 0x23, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ImageDynamicallyRelocated' : [ 0x23, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ImageMappedFlat' : [ 0x23, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x23, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ComPlusNativeReady' : [ 0x23, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x23, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x23, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x23, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x23, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'LoaderFlags' : [ 0x24, ['unsigned long']], 'ImageFileSize' : [ 0x28, ['unsigned long']], 'CheckSum' : [ 0x2c, ['unsigned long']], @@ -1938,10 +1938,10 @@ nt_types = { 'ResumeContextPages' : [ 0xdc, ['unsigned long']], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'BATTERY_REPORTING_SCALE' : [ 0x8, { @@ -1967,13 +1967,13 @@ nt_types = { 'FileRuns' : [ 0x50, ['unsigned long']], } ], '_DEVICE_FLAGS' : [ 0x4, { - 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], } ], '_RTL_BALANCED_LINKS' : [ 0x10, { 'Parent' : [ 0x0, ['pointer', ['_RTL_BALANCED_LINKS']]], @@ -1984,21 +1984,21 @@ nt_types = { } ], '_MMVIEW' : [ 0x18, { 'Entry' : [ 0x0, ['unsigned long']], - 'Writable' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Writable' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], 'ControlArea' : [ 0x4, ['pointer', ['_CONTROL_AREA']]], 'ViewLinks' : [ 0x8, ['_LIST_ENTRY']], 'SessionViewVa' : [ 0x10, ['pointer', ['void']]], 'SessionId' : [ 0x14, ['unsigned long']], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_HEADLESS_LOADER_BLOCK' : [ 0x34, { 'UsedBiosSettings' : [ 0x0, ['unsigned char']], @@ -2213,19 +2213,19 @@ nt_types = { 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], 'SafeBootMode' : [ 0x2ec, ['unsigned char']], 'TscQpcData' : [ 0x2ed, ['unsigned char']], - 'TscQpcEnabled' : [ 0x2ed, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'TscQpcSpareFlag' : [ 0x2ed, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'TscQpcShift' : [ 0x2ed, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'TscQpcEnabled' : [ 0x2ed, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TscQpcSpareFlag' : [ 0x2ed, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'TscQpcShift' : [ 0x2ed, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], 'TscQpcPad' : [ 0x2ee, ['array', 2, ['unsigned char']]], 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], - 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], 'DataFlagsPad' : [ 0x2f4, ['array', 1, ['unsigned long']]], 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], 'SystemCall' : [ 0x300, ['unsigned long']], @@ -2276,9 +2276,9 @@ nt_types = { 'QuadPart' : [ 0x0, ['long long']], } ], '__unnamed_105e' : [ 0x4, { - 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1060' : [ 0x4, { 'Flags' : [ 0x0, ['unsigned long']], @@ -2392,20 +2392,20 @@ nt_types = { 'MergedPrefLanguages' : [ 0xfc0, ['pointer', ['void']]], 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], - 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0xfca, ['unsigned short']], - 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16)]], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0xfcc, ['pointer', ['void']]], 'TxnScopeExitCallback' : [ 0xfd0, ['pointer', ['void']]], 'TxnScopeContext' : [ 0xfd4, ['pointer', ['void']]], @@ -2637,7 +2637,7 @@ nt_types = { 'DpcRequestSummary' : [ 0x1934, ['long']], 'DpcRequestSlot' : [ 0x1934, ['array', 2, ['short']]], 'NormalDpcState' : [ 0x1934, ['short']], - 'DpcThreadActive' : [ 0x1936, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'DpcThreadActive' : [ 0x1936, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], 'ThreadDpcState' : [ 0x1936, ['short']], 'TimerHand' : [ 0x1938, ['unsigned long']], 'LastTick' : [ 0x193c, ['unsigned long']], @@ -2794,20 +2794,20 @@ nt_types = { 'WaitRegister' : [ 0x38, ['_KWAIT_STATUS_REGISTER']], 'Running' : [ 0x39, ['unsigned char']], 'Alerted' : [ 0x3a, ['array', 2, ['unsigned char']]], - 'KernelStackResident' : [ 0x3c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadyTransition' : [ 0x3c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessReadyQueue' : [ 0x3c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WaitNext' : [ 0x3c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemAffinityActive' : [ 0x3c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Alertable' : [ 0x3c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'GdiFlushActive' : [ 0x3c, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'UserStackWalkActive' : [ 0x3c, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ApcInterruptRequest' : [ 0x3c, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'ForceDeferSchedule' : [ 0x3c, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'QuantumEndMigrate' : [ 0x3c, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'UmsDirectedSwitchEnable' : [ 0x3c, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'TimerActive' : [ 0x3c, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Reserved' : [ 0x3c, ['BitField', dict(start_bit = 13, end_bit = 32)]], + 'KernelStackResident' : [ 0x3c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x3c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessReadyQueue' : [ 0x3c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WaitNext' : [ 0x3c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x3c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Alertable' : [ 0x3c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GdiFlushActive' : [ 0x3c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x3c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ApcInterruptRequest' : [ 0x3c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ForceDeferSchedule' : [ 0x3c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'QuantumEndMigrate' : [ 0x3c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'UmsDirectedSwitchEnable' : [ 0x3c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'TimerActive' : [ 0x3c, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Reserved' : [ 0x3c, ['BitField', dict(start_bit = 13, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x3c, ['long']], 'ApcState' : [ 0x40, ['_KAPC_STATE']], 'ApcStateFill' : [ 0x40, ['array', 23, ['unsigned char']]], @@ -2831,16 +2831,16 @@ nt_types = { 'CombinedApcDisable' : [ 0x84, ['unsigned long']], 'Teb' : [ 0x88, ['pointer', ['void']]], 'Timer' : [ 0x90, ['_KTIMER']], - 'AutoAlignment' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xb8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwStackTraceApc1Inserted' : [ 0xb8, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EtwStackTraceApc2Inserted' : [ 0xb8, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CalloutActive' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ApcQueueable' : [ 0xb8, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'EnableStackSwap' : [ 0xb8, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'GuiThread' : [ 0xb8, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'UmsPerformingSyscall' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'ReservedFlags' : [ 0xb8, ['BitField', dict(start_bit = 9, end_bit = 32)]], + 'AutoAlignment' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0xb8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'EtwStackTraceApc1Inserted' : [ 0xb8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EtwStackTraceApc2Inserted' : [ 0xb8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CalloutActive' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ApcQueueable' : [ 0xb8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0xb8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'GuiThread' : [ 0xb8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'UmsPerformingSyscall' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xb8, ['BitField', dict(start_bit = 9, end_bit = 32, native_type='unsigned long')]], 'ThreadFlags' : [ 0xb8, ['long']], 'ServiceTable' : [ 0xbc, ['pointer', ['void']]], 'WaitBlock' : [ 0xc0, ['array', 4, ['_KWAIT_BLOCK']]], @@ -2852,8 +2852,8 @@ nt_types = { 'ApcStateIndex' : [ 0x134, ['unsigned char']], 'BasePriority' : [ 0x135, ['unsigned char']], 'PriorityDecrement' : [ 0x136, ['unsigned char']], - 'ForegroundBoost' : [ 0x136, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'UnusualBoost' : [ 0x136, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ForegroundBoost' : [ 0x136, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'UnusualBoost' : [ 0x136, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'Preempted' : [ 0x137, ['unsigned char']], 'AdjustReason' : [ 0x138, ['unsigned char']], 'AdjustIncrement' : [ 0x139, ['unsigned char']], @@ -2939,11 +2939,11 @@ nt_types = { 'Information' : [ 0x4, ['unsigned long']], } ], '_EX_PUSH_LOCK' : [ 0x4, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -2985,7 +2985,7 @@ nt_types = { } ], '_EX_FAST_REF' : [ 0x4, { 'Object' : [ 0x0, ['pointer', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], } ], '_EX_PUSH_LOCK_WAIT_BLOCK' : [ 0x30, { @@ -3026,51 +3026,51 @@ nt_types = { 'ReadClusterSize' : [ 0x278, ['unsigned long']], 'MmLockOrdering' : [ 0x27c, ['long']], 'CrossThreadFlags' : [ 0x280, ['unsigned long']], - 'Terminated' : [ 0x280, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ThreadInserted' : [ 0x280, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x280, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x280, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x280, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x280, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x280, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x280, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x280, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyTokenOnOpen' : [ 0x280, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ThreadIoPriority' : [ 0x280, ['BitField', dict(start_bit = 10, end_bit = 13)]], - 'ThreadPagePriority' : [ 0x280, ['BitField', dict(start_bit = 13, end_bit = 16)]], - 'RundownFail' : [ 0x280, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NeedsWorkingSetAging' : [ 0x280, ['BitField', dict(start_bit = 17, end_bit = 18)]], + 'Terminated' : [ 0x280, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x280, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x280, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x280, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x280, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x280, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x280, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x280, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x280, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x280, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x280, ['BitField', dict(start_bit = 10, end_bit = 13, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x280, ['BitField', dict(start_bit = 13, end_bit = 16, native_type='unsigned long')]], + 'RundownFail' : [ 0x280, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NeedsWorkingSetAging' : [ 0x280, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x284, ['unsigned long']], - 'ActiveExWorker' : [ 0x284, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x284, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x284, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ClonedThread' : [ 0x284, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'KeyedEventInUse' : [ 0x284, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RateApcState' : [ 0x284, ['BitField', dict(start_bit = 5, end_bit = 7)]], - 'SelfTerminate' : [ 0x284, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveExWorker' : [ 0x284, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x284, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x284, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x284, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x284, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RateApcState' : [ 0x284, ['BitField', dict(start_bit = 5, end_bit = 7, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x284, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x288, ['unsigned long']], - 'Spare' : [ 0x288, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'StartAddressInvalid' : [ 0x288, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwPageFaultCalloutActive' : [ 0x288, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x288, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemCacheWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemCacheWorkingSetShared' : [ 0x288, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x289, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsProcessAddressSpaceExclusive' : [ 0x289, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsProcessAddressSpaceShared' : [ 0x289, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SuppressSymbolLoad' : [ 0x289, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Prefetching' : [ 0x289, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsDynamicMemoryShared' : [ 0x289, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsChangeControlAreaExclusive' : [ 0x289, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsChangeControlAreaShared' : [ 0x289, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsPagedPoolWorkingSetExclusive' : [ 0x28a, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsPagedPoolWorkingSetShared' : [ 0x28a, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsSystemPtesWorkingSetExclusive' : [ 0x28a, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsSystemPtesWorkingSetShared' : [ 0x28a, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'TrimTrigger' : [ 0x28a, ['BitField', dict(start_bit = 4, end_bit = 6)]], - 'Spare1' : [ 0x28a, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'Spare' : [ 0x288, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x288, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EtwPageFaultCalloutActive' : [ 0x288, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x288, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetShared' : [ 0x288, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x289, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceExclusive' : [ 0x289, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x289, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x289, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Prefetching' : [ 0x289, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsDynamicMemoryShared' : [ 0x289, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsChangeControlAreaExclusive' : [ 0x289, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsChangeControlAreaShared' : [ 0x289, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetExclusive' : [ 0x28a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetShared' : [ 0x28a, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetExclusive' : [ 0x28a, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetShared' : [ 0x28a, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'TrimTrigger' : [ 0x28a, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], + 'Spare1' : [ 0x28a, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], 'PriorityRegionActive' : [ 0x28b, ['unsigned char']], 'CacheManagerActive' : [ 0x28c, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x28d, ['unsigned char']], @@ -3105,7 +3105,7 @@ nt_types = { 'DebugPort' : [ 0xec, ['pointer', ['void']]], 'ExceptionPortData' : [ 0xf0, ['pointer', ['void']]], 'ExceptionPortValue' : [ 0xf0, ['unsigned long']], - 'ExceptionPortState' : [ 0xf0, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'ExceptionPortState' : [ 0xf0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'ObjectTable' : [ 0xf4, ['pointer', ['_HANDLE_TABLE']]], 'Token' : [ 0xf8, ['_EX_FAST_REF']], 'WorkingSetPage' : [ 0xfc, ['unsigned long']], @@ -3163,56 +3163,56 @@ nt_types = { 'HighestUserAddress' : [ 0x264, ['pointer', ['void']]], 'ModifiedPageCount' : [ 0x268, ['unsigned long']], 'Flags2' : [ 0x26c, ['unsigned long']], - 'JobNotReallyActive' : [ 0x26c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AccountingFolded' : [ 0x26c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'NewProcessReported' : [ 0x26c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ExitProcessReported' : [ 0x26c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReportCommitChanges' : [ 0x26c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LastReportMemory' : [ 0x26c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ReportPhysicalPageChanges' : [ 0x26c, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'HandleTableRundown' : [ 0x26c, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'NeedsHandleRundown' : [ 0x26c, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RefTraceEnabled' : [ 0x26c, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'NumaAware' : [ 0x26c, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtectedProcess' : [ 0x26c, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'DefaultPagePriority' : [ 0x26c, ['BitField', dict(start_bit = 12, end_bit = 15)]], - 'PrimaryTokenFrozen' : [ 0x26c, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessVerifierTarget' : [ 0x26c, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'StackRandomizationDisabled' : [ 0x26c, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'AffinityPermanent' : [ 0x26c, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'AffinityUpdateEnable' : [ 0x26c, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'PropagateNode' : [ 0x26c, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'ExplicitAffinity' : [ 0x26c, ['BitField', dict(start_bit = 21, end_bit = 22)]], + 'JobNotReallyActive' : [ 0x26c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x26c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x26c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x26c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x26c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x26c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ReportPhysicalPageChanges' : [ 0x26c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'HandleTableRundown' : [ 0x26c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x26c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x26c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'NumaAware' : [ 0x26c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtectedProcess' : [ 0x26c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x26c, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x26c, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x26c, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x26c, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x26c, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x26c, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PropagateNode' : [ 0x26c, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'ExplicitAffinity' : [ 0x26c, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], 'Flags' : [ 0x270, ['unsigned long']], - 'CreateReported' : [ 0x270, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x270, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x270, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x270, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x270, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x270, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x270, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x270, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x270, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x270, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x270, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x270, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x270, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'DeprioritizeViews' : [ 0x270, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x270, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x270, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x270, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x270, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x270, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x270, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x270, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x270, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x270, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x270, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'CrossSessionCreate' : [ 0x270, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'ProcessInserted' : [ 0x270, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x270, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'ProcessSelfDelete' : [ 0x270, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'SetTimerResolutionLink' : [ 0x270, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x270, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x270, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x270, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x270, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x270, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x270, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x270, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x270, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x270, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x270, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x270, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x270, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x270, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x270, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x270, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x270, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x270, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x270, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x270, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x270, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x270, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x270, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x270, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x270, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x270, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x270, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x270, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x270, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SetTimerResolutionLink' : [ 0x270, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x274, ['long']], 'VadRoot' : [ 0x278, ['_MM_AVL_TABLE']], 'AlpcContext' : [ 0x298, ['_ALPC_PROCESS_CONTEXT']], @@ -3234,11 +3234,11 @@ nt_types = { 'ReadyListHead' : [ 0x44, ['_LIST_ENTRY']], 'SwapListEntry' : [ 0x4c, ['_SINGLE_LIST_ENTRY']], 'ActiveProcessors' : [ 0x50, ['_KAFFINITY_EX']], - 'AutoAlignment' : [ 0x5c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x5c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0x5c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveGroupsMask' : [ 0x5c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReservedFlags' : [ 0x5c, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'AutoAlignment' : [ 0x5c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x5c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x5c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ActiveGroupsMask' : [ 0x5c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x5c, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='long')]], 'ProcessFlags' : [ 0x5c, ['long']], 'BasePriority' : [ 0x60, ['unsigned char']], 'QuantumReset' : [ 0x61, ['unsigned char']], @@ -3743,8 +3743,8 @@ nt_types = { 'Flags' : [ 0x4, ['unsigned char']], 'IsFastIoPossible' : [ 0x5, ['unsigned char']], 'Flags2' : [ 0x6, ['unsigned char']], - 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'Resource' : [ 0x8, ['pointer', ['_ERESOURCE']]], 'PagingIoResource' : [ 0xc, ['pointer', ['_ERESOURCE']]], 'AllocationSize' : [ 0x10, ['_LARGE_INTEGER']], @@ -3847,11 +3847,11 @@ nt_types = { 'e2' : [ 0x0, ['__unnamed_14f4']], } ], '__unnamed_14fb' : [ 0x4, { - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25)]], - 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], } ], '_MMPFN' : [ 0x18, { 'u1' : [ 0x0, ['__unnamed_14ef']], @@ -3932,10 +3932,10 @@ nt_types = { 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], 'WritableUserReferences' : [ 0x4, ['long']], - 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30)]], - 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30, native_type='unsigned long')]], + 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubsectionRoot' : [ 0x8, ['pointer', ['_MM_SUBSECTION_AVL_TABLE']]], 'SeImageStub' : [ 0x8, ['pointer', ['_MI_IMAGE_SECURITY_REFERENCE']]], } ], @@ -3961,8 +3961,8 @@ nt_types = { 'ViewList' : [ 0x48, ['_LIST_ENTRY']], } ], '_MM_STORE_KEY' : [ 0x4, { - 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 28)]], - 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], + 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 28, native_type='unsigned long')]], + 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], 'EntireKey' : [ 0x0, ['unsigned long']], } ], '_MMPAGING_FILE' : [ 0x50, { @@ -3980,11 +3980,11 @@ nt_types = { 'BitmapHint' : [ 0x34, ['unsigned long']], 'LastAllocationSize' : [ 0x38, ['unsigned long']], 'ToBeEvictedCount' : [ 0x3c, ['unsigned long']], - 'PageFileNumber' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'BootPartition' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Spare0' : [ 0x40, ['BitField', dict(start_bit = 5, end_bit = 16)]], - 'AdriftMdls' : [ 0x42, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare1' : [ 0x42, ['BitField', dict(start_bit = 1, end_bit = 16)]], + 'PageFileNumber' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'BootPartition' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Spare0' : [ 0x40, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x42, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare1' : [ 0x42, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], 'FileHandle' : [ 0x44, ['pointer', ['void']]], 'Lock' : [ 0x48, ['unsigned long']], 'LockOwner' : [ 0x4c, ['pointer', ['_ETHREAD']]], @@ -3995,14 +3995,14 @@ nt_types = { } ], '_MM_AVL_TABLE' : [ 0x20, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'NodeHint' : [ 0x18, ['pointer', ['void']]], 'NodeFreeHint' : [ 0x1c, ['pointer', ['void']]], } ], '__unnamed_1580' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMVAD']]], } ], '__unnamed_1583' : [ 0x4, { @@ -4024,7 +4024,7 @@ nt_types = { 'u5' : [ 0x1c, ['__unnamed_1586']], } ], '__unnamed_158e' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x14, { @@ -4208,16 +4208,16 @@ nt_types = { } ], '_CM_KEY_CONTROL_BLOCK' : [ 0xa0, { 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31)]], - 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31, native_type='unsigned long')]], + 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'KeyHash' : [ 0xc, ['_CM_KEY_HASH']], 'ConvKey' : [ 0xc, ['unsigned long']], 'NextHash' : [ 0x10, ['pointer', ['_CM_KEY_HASH']]], @@ -4241,10 +4241,10 @@ nt_types = { 'KcbMaxNameLen' : [ 0x60, ['unsigned short']], 'KcbMaxValueNameLen' : [ 0x62, ['unsigned short']], 'KcbMaxValueDataLen' : [ 0x64, ['unsigned long']], - 'KcbUserFlags' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'KcbVirtControlFlags' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'KcbDebug' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Flags' : [ 0x68, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'KcbUserFlags' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0x68, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'KCBUoWListHead' : [ 0x6c, ['_LIST_ENTRY']], 'DelayQueueEntry' : [ 0x74, ['_LIST_ENTRY']], 'Stolen' : [ 0x74, ['pointer', ['unsigned char']]], @@ -4446,20 +4446,20 @@ nt_types = { 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], - 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0xfca, ['unsigned short']], - 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16)]], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], @@ -4549,20 +4549,20 @@ nt_types = { 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16)]], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], @@ -4645,9 +4645,9 @@ nt_types = { 'PreviousTrapFrame' : [ 0x0, ['pointer', ['_KTRAP_FRAME']]], 'PreviousExceptionList' : [ 0x0, ['pointer', ['void']]], 'StackControlFlags' : [ 0x4, ['unsigned long']], - 'PreviousLargeStack' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousSegmentsPresent' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ExpandCalloutStack' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'PreviousLargeStack' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousSegmentsPresent' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ExpandCalloutStack' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'Previous' : [ 0x8, ['_KERNEL_STACK_SEGMENT']], } ], '_KTRAP_FRAME' : [ 0x8c, { @@ -5300,12 +5300,12 @@ nt_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['pointer', ['void']]], 'ImageBaseAddress' : [ 0x8, ['pointer', ['void']]], 'Ldr' : [ 0xc, ['pointer', ['_PEB_LDR_DATA']]], @@ -5316,12 +5316,12 @@ nt_types = { 'AtlThunkSListPtr' : [ 0x20, ['pointer', ['void']]], 'IFEOKey' : [ 0x24, ['pointer', ['void']]], 'CrossProcessFlags' : [ 0x28, ['unsigned long']], - 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32)]], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x2c, ['pointer', ['void']]], 'UserSharedInfoPtr' : [ 0x2c, ['pointer', ['void']]], 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], @@ -5384,9 +5384,9 @@ nt_types = { 'pContextData' : [ 0x238, ['pointer', ['void']]], 'pImageHeaderHash' : [ 0x23c, ['pointer', ['void']]], 'TracingFlags' : [ 0x240, ['unsigned long']], - 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_PEB_LDR_DATA' : [ 0x30, { 'Length' : [ 0x0, ['unsigned long']], @@ -5482,10 +5482,10 @@ nt_types = { 'LookasideIndex' : [ 0x20, ['unsigned long']], } ], '__unnamed_197e' : [ 0x1, { - 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], } ], '__unnamed_1980' : [ 0x1, { 's1' : [ 0x0, ['__unnamed_197e']], @@ -5502,8 +5502,8 @@ nt_types = { 'Pad' : [ 0x14, ['unsigned long']], } ], '__unnamed_1992' : [ 0x4, { - 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_1994' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1992']], @@ -5520,7 +5520,7 @@ nt_types = { 'RegionListHead' : [ 0x20, ['_LIST_ENTRY']], } ], '__unnamed_199a' : [ 0x4, { - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], } ], '__unnamed_199c' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_199a']], @@ -5538,9 +5538,9 @@ nt_types = { 'ReadWriteView' : [ 0x2c, ['pointer', ['_KALPC_VIEW']]], } ], '__unnamed_19a2' : [ 0x4, { - 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], } ], '__unnamed_19a4' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19a2']], @@ -5566,22 +5566,22 @@ nt_types = { 'HandleTable' : [ 0x14, ['_ALPC_HANDLE_TABLE']], } ], '__unnamed_19c0' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], } ], '__unnamed_19c2' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19c0']], @@ -5637,18 +5637,18 @@ nt_types = { 'CallbackList' : [ 0x80, ['_LIST_ENTRY']], } ], '__unnamed_19da' : [ 0x4, { - 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], } ], '__unnamed_19dc' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19da']], @@ -5705,8 +5705,8 @@ nt_types = { 'HandleData' : [ 0x18, ['pointer', ['_KALPC_HANDLE_DATA']]], } ], '__unnamed_1a19' : [ 0x4, { - 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_1a1b' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1a19']], @@ -5898,23 +5898,23 @@ nt_types = { 'SecurityDescriptor' : [ 0x21c, ['_EX_FAST_REF']], 'BufferSequenceNumber' : [ 0x220, ['long long']], 'Flags' : [ 0x228, ['unsigned long']], - 'Persistent' : [ 0x228, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoLogger' : [ 0x228, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'FsReady' : [ 0x228, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RealTime' : [ 0x228, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow' : [ 0x228, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelTrace' : [ 0x228, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'NoMoreEnable' : [ 0x228, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'StackTracing' : [ 0x228, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ErrorLogged' : [ 0x228, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RealtimeLoggerContextFreed' : [ 0x228, ['BitField', dict(start_bit = 9, end_bit = 10)]], + 'Persistent' : [ 0x228, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x228, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x228, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x228, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x228, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x228, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x228, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'StackTracing' : [ 0x228, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ErrorLogged' : [ 0x228, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RealtimeLoggerContextFreed' : [ 0x228, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], 'RequestFlag' : [ 0x22c, ['unsigned long']], - 'RequestNewFie' : [ 0x22c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'RequestUpdateFile' : [ 0x22c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'RequestFlush' : [ 0x22c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RequestDisableRealtime' : [ 0x22c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RequestDisconnectConsumer' : [ 0x22c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RequestConnectConsumer' : [ 0x22c, ['BitField', dict(start_bit = 5, end_bit = 6)]], + 'RequestNewFie' : [ 0x22c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RequestUpdateFile' : [ 0x22c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'RequestFlush' : [ 0x22c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RequestDisableRealtime' : [ 0x22c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequestDisconnectConsumer' : [ 0x22c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RequestConnectConsumer' : [ 0x22c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], 'HookIdMap' : [ 0x230, ['_RTL_BITMAP']], } ], '_ETW_LOGGER_HANDLE' : [ 0x1, { @@ -5964,8 +5964,8 @@ nt_types = { 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], 'LoggerId' : [ 0x8, ['unsigned short']], 'Level' : [ 0xa, ['unsigned char']], - 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_TRACE_ENABLE_CONTEXT' : [ 0x8, { 'LoggerId' : [ 0x0, ['unsigned short']], @@ -6112,8 +6112,8 @@ nt_types = { '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x4, { 'ImpersonationData' : [ 0x0, ['unsigned long']], 'ImpersonationToken' : [ 0x0, ['pointer', ['void']]], - 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], } ], '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], @@ -6124,12 +6124,12 @@ nt_types = { 'PpcControlSet' : [ 0x0, ['_PPC_DBGKD_CONTROL_SET']], } ], '_MMVAD_FLAGS3' : [ 0x4, { - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6)]], - 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24)]], - 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned long')]], + 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24, native_type='unsigned long')]], + 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_MI_VERIFIER_POOL_HEADER' : [ 0x4, { 'VerifierPoolEntry' : [ 0x0, ['pointer', ['_VI_POOL_ENTRY']]], @@ -6192,19 +6192,19 @@ nt_types = { 'Request' : [ 0x18, ['_PORT_MESSAGE']], } ], '_HARDWARE_PTE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_DUAL' : [ 0x13c, { 'Length' : [ 0x0, ['unsigned long']], @@ -6239,36 +6239,36 @@ nt_types = { } ], '_KSTACK_COUNT' : [ 0x4, { 'Value' : [ 0x0, ['long']], - 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], } ], '_DISPATCHER_HEADER' : [ 0x10, { 'Type' : [ 0x0, ['unsigned char']], 'TimerControlFlags' : [ 0x1, ['unsigned char']], - 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Coalescable' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'KeepShifting' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Coalescable' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KeepShifting' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], 'Abandoned' : [ 0x1, ['unsigned char']], 'Signalling' : [ 0x1, ['unsigned char']], 'ThreadControlFlags' : [ 0x2, ['unsigned char']], - 'CpuThrottled' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'CpuThrottled' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], 'Hand' : [ 0x2, ['unsigned char']], 'Size' : [ 0x2, ['unsigned char']], 'TimerMiscFlags' : [ 0x3, ['unsigned char']], - 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Processor' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 6)]], - 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Processor' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned char')]], + 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], 'DebugActive' : [ 0x3, ['unsigned char']], - 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved2' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved2' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned char')]], + 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], 'DpcActive' : [ 0x3, ['unsigned char']], 'Lock' : [ 0x0, ['long']], 'SignalState' : [ 0x4, ['long']], @@ -6283,8 +6283,8 @@ nt_types = { 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], 'FileOffset' : [ 0x0, ['unsigned long long']], 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], - 'DontUse0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'DontUse0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'PointerProtoPte' : [ 0x4, ['pointer', ['void']]], } ], '_HEAP_COUNTERS' : [ 0x54, { @@ -6381,7 +6381,7 @@ nt_types = { 'DebugInfo' : [ 0x1c, ['pointer', ['_HANDLE_TRACE_DEBUG_INFO']]], 'ExtraInfoPages' : [ 0x20, ['long']], 'Flags' : [ 0x24, ['unsigned long']], - 'StrictFIFO' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], 'FirstFreeHandle' : [ 0x28, ['unsigned long']], 'LastFreeHandleEntry' : [ 0x2c, ['pointer', ['_HANDLE_TABLE_ENTRY']]], 'HandleCount' : [ 0x30, ['unsigned long']], @@ -6395,15 +6395,15 @@ nt_types = { 'NumberOfBytes' : [ 0xc, ['unsigned long']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_TEB_ACTIVE_FRAME' : [ 0xc, { 'Flags' : [ 0x0, ['unsigned long']], @@ -6424,8 +6424,8 @@ nt_types = { 'NotifyBlock' : [ 0x8, ['pointer', ['_CM_NOTIFY_BLOCK']]], 'ProcessID' : [ 0xc, ['pointer', ['void']]], 'KeyBodyList' : [ 0x10, ['_LIST_ENTRY']], - 'Flags' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'HandleTags' : [ 0x18, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'Flags' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'HandleTags' : [ 0x18, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'KtmTrans' : [ 0x1c, ['pointer', ['void']]], 'KtmUow' : [ 0x20, ['pointer', ['_GUID']]], 'ContextListHead' : [ 0x24, ['_LIST_ENTRY']], @@ -6440,20 +6440,20 @@ nt_types = { 'BlockState' : [ 0x17, ['unsigned char']], } ], '_MMPTE_PROTOTYPE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 9)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 9, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_THERMAL_INFORMATION_EX' : [ 0x58, { @@ -6470,15 +6470,15 @@ nt_types = { 'S4TransitionTripPoint' : [ 0x54, ['unsigned long']], } ], '__unnamed_1c1b' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], } ], '__unnamed_1c1d' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], } ], '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { 'File' : [ 0x0, ['__unnamed_1c1b']], @@ -6490,14 +6490,14 @@ nt_types = { 'Parameters' : [ 0x8, ['array', 2, ['unsigned long']]], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16)]], - 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16)]], + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], } ], '_EXCEPTION_POINTERS' : [ 0x8, { 'ExceptionRecord' : [ 0x0, ['pointer', ['_EXCEPTION_RECORD']]], @@ -6565,9 +6565,9 @@ nt_types = { 'u4' : [ 0x44, ['__unnamed_1c45']], } ], '_MMWSLE_FREE_ENTRY' : [ 0x4, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 12)]], - 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 12, native_type='unsigned long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_NT_TIB' : [ 0x1c, { 'ExceptionList' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], @@ -6630,10 +6630,10 @@ nt_types = { } ], '__unnamed_1c56' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_IDLE_STATES' : [ 0x68, { 'Count' : [ 0x0, ['unsigned long']], @@ -6650,8 +6650,8 @@ nt_types = { 'PcatInformation' : [ 0x0, ['_PCAT_FIRMWARE_INFORMATION']], } ], '_FIRMWARE_INFORMATION_LOADER_BLOCK' : [ 0x14, { - 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'u' : [ 0x4, ['__unnamed_1c5f']], } ], '_HEAP_UCR_DESCRIPTOR' : [ 0x18, { @@ -6689,16 +6689,16 @@ nt_types = { 'BaseHi' : [ 0x3, ['unsigned char']], } ], '__unnamed_1c6e' : [ 0x4, { - 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1c70' : [ 0x4, { 'Bytes' : [ 0x0, ['__unnamed_1c68']], @@ -6768,9 +6768,9 @@ nt_types = { 'PostList' : [ 0x8, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x10, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x14, ['pointer', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_KINTERRUPT' : [ 0x278, { @@ -6892,19 +6892,19 @@ nt_types = { 'Lock' : [ 0xc, ['_EX_PUSH_LOCK']], } ], '_MMPTE_HARDWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x8, { 'Port' : [ 0x0, ['pointer', ['void']]], @@ -7031,13 +7031,13 @@ nt_types = { 'List' : [ 0x4, ['unsigned long']], } ], '_MMVAD_FLAGS' : [ 0x4, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_MMWSLE_HASH' : [ 0x4, { 'Index' : [ 0x0, ['unsigned long']], @@ -7074,10 +7074,10 @@ nt_types = { } ], '_VF_TRACKER_STAMP' : [ 0x8, { 'Thread' : [ 0x0, ['pointer', ['void']]], - 'Flags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'OldIrql' : [ 0x5, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'NewIrql' : [ 0x6, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Processor' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Flags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x5, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0x6, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], } ], '_VI_TRACK_IRQL' : [ 0x20, { 'Thread' : [ 0x0, ['pointer', ['void']]], @@ -7121,7 +7121,7 @@ nt_types = { '_XSTATE_CONFIGURATION' : [ 0x210, { 'EnabledFeatures' : [ 0x0, ['unsigned long long']], 'Size' : [ 0x8, ['unsigned long']], - 'OptimizedSave' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'OptimizedSave' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], 'Features' : [ 0x10, ['array', 64, ['_XSTATE_FEATURE']]], } ], '_CM_KEY_SECURITY_CACHE' : [ 0x2c, { @@ -7133,12 +7133,12 @@ nt_types = { 'Descriptor' : [ 0x18, ['_SECURITY_DESCRIPTOR_RELATIVE']], } ], '_MMPTE_SOFTWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_NT_TIB32' : [ 0x1c, { 'ExceptionList' : [ 0x0, ['unsigned long']], @@ -7165,9 +7165,9 @@ nt_types = { } ], '_MM_SUBSECTION_AVL_TABLE' : [ 0x20, { 'BalancedRoot' : [ 0x0, ['_MMSUBSECTION_NODE']], - 'DepthOfTree' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x18, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DepthOfTree' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x18, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'NodeHint' : [ 0x1c, ['pointer', ['void']]], } ], '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { @@ -7179,13 +7179,13 @@ nt_types = { 'PartialResourceList' : [ 0x8, ['_CM_PARTIAL_RESOURCE_LIST']], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { - 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_WMI_BUFFER_HEADER' : [ 0x48, { @@ -7265,17 +7265,17 @@ nt_types = { 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], - 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEGMENT_OBJECT' : [ 0x28, { 'BaseAddress' : [ 0x0, ['pointer', ['void']]], @@ -7362,21 +7362,21 @@ nt_types = { 'DataLength' : [ 0x8, ['unsigned long']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], } ], '_IMAGE_OPTIONAL_HEADER' : [ 0xe0, { 'Magic' : [ 0x0, ['unsigned short']], @@ -7522,9 +7522,9 @@ nt_types = { } ], '_OWNER_ENTRY' : [ 0x8, { 'OwnerThread' : [ 0x0, ['unsigned long']], - 'IoPriorityBoosted' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnerReferenced' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnerCount' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'IoPriorityBoosted' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OwnerReferenced' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OwnerCount' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'TableSize' : [ 0x4, ['unsigned long']], } ], '_MI_SECTION_CREATION_GATE' : [ 0x14, { @@ -7652,26 +7652,26 @@ nt_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -7781,12 +7781,12 @@ nt_types = { 'Metrics' : [ 0xe8, ['_POP_THERMAL_ZONE_METRICS']], } ], '_MMPTE_LIST' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_VI_POOL_PAGE_HEADER' : [ 0xc, { 'NextPage' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], @@ -7832,10 +7832,10 @@ nt_types = { 'HiveArray' : [ 0x48, ['array', 7, ['pointer', ['_CMHIVE']]]], } ], '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { - 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x18, { @@ -7913,8 +7913,8 @@ nt_types = { 'PolicySetStatus' : [ 0x1b, ['unsigned char']], } ], '__unnamed_1e88' : [ 0x4, { - 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1e8a' : [ 0xc, { 'AllSharedExportThunks' : [ 0x0, ['_VF_TARGET_ALL_SHARED_EXPORT_THUNKS']], @@ -7992,12 +7992,12 @@ nt_types = { 'BaseName' : [ 0x10, ['_UNICODE_STRING']], } ], '_MMPTE_TIMESTAMP' : [ 0x4, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_SID_AND_ATTRIBUTES_HASH' : [ 0x88, { 'SidCount' : [ 0x0, ['unsigned long']], @@ -8051,8 +8051,8 @@ nt_types = { 'SessionId' : [ 0x8, ['unsigned long']], 'CpuShareWeight' : [ 0xc, ['unsigned long']], 'CapturedWeightData' : [ 0x10, ['_PSP_CPU_SHARE_CAPTURED_WEIGHT_DATA']], - 'DuplicateInputMarker' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x18, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'DuplicateInputMarker' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x18, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x18, ['long']], 'BlockCurrentGenerationLock' : [ 0x0, ['unsigned long']], 'CyclesAccumulated' : [ 0x8, ['unsigned long long']], @@ -8064,10 +8064,10 @@ nt_types = { } ], '__unnamed_1ec1' : [ 0x1, { 'AsUCHAR' : [ 0x0, ['unsigned char']], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], } ], 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { 'Revision' : [ 0x0, ['unsigned long']], @@ -8099,25 +8099,25 @@ nt_types = { 'Busy' : [ 0x10, ['unsigned char']], } ], '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'ContextAsUlong' : [ 0x0, ['unsigned long']], } ], '_OBJECT_TYPE_INITIALIZER' : [ 0x50, { 'Length' : [ 0x0, ['unsigned short']], 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], - 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], 'ObjectTypeCode' : [ 0x4, ['unsigned long']], 'InvalidAttributes' : [ 0x8, ['unsigned long']], 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], @@ -8178,14 +8178,14 @@ nt_types = { 'ActualLimit' : [ 0x10, ['unsigned long']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], 'ExecuteOptions' : [ 0x0, ['unsigned char']], } ], '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { @@ -8219,13 +8219,13 @@ nt_types = { 'Reserved' : [ 0xc, ['unsigned long']], } ], '_MMWSLENTRY' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_DBGKD_SWITCH_PARTITION' : [ 0x4, { 'Partition' : [ 0x0, ['unsigned long']], @@ -8254,15 +8254,15 @@ nt_types = { 'Exchg' : [ 0x0, ['long long']], } ], '_WHEA_TIMESTAMP' : [ 0x8, { - 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32)]], - 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40)]], - 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48)]], - 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56)]], - 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64)]], + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], } ], '_VPB' : [ 0x58, { @@ -8348,10 +8348,10 @@ nt_types = { 'HandleAttributes' : [ 0x14, ['unsigned long']], } ], '_MMPTE_SUBSECTION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_POWER_STATE' : [ 0x4, { 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], @@ -8468,7 +8468,7 @@ nt_types = { 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], } ], '__unnamed_1f80' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMSUBSECTION_NODE']]], } ], '_MMSUBSECTION_NODE' : [ 0x18, { @@ -8511,9 +8511,9 @@ nt_types = { 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { - 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], 'AsUCHAR' : [ 0x0, ['unsigned char']], } ], '_FS_FILTER_CALLBACKS' : [ 0x38, { @@ -8684,10 +8684,10 @@ nt_types = { 'BankTemplate' : [ 0x1c, ['array', 1, ['_MMPTE']]], } ], '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { - 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_XSAVE_AREA_HEADER' : [ 0x40, { diff --git a/volatility/plugins/overlays/windows/win7_sp1_x64_vtypes.py b/volatility/plugins/overlays/windows/win7_sp1_x64_vtypes.py index b86478d9..d9c4c4b7 100644 --- a/volatility/plugins/overlays/windows/win7_sp1_x64_vtypes.py +++ b/volatility/plugins/overlays/windows/win7_sp1_x64_vtypes.py @@ -123,10 +123,10 @@ ntkrnlmp_types = { 'BankTemplate' : [ 0x30, ['array', 1, ['_MMPTE']]], } ], '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { - 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_XSAVE_AREA_HEADER' : [ 0x40, { @@ -235,9 +235,9 @@ ntkrnlmp_types = { } ], '__unnamed_205c' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_PERF_STATES' : [ 0xb0, { 'Count' : [ 0x0, ['unsigned long']], @@ -381,10 +381,10 @@ ntkrnlmp_types = { '_IMAGE_SECURITY_CONTEXT' : [ 0x8, { 'PageHashes' : [ 0x0, ['pointer64', ['void']]], 'Value' : [ 0x0, ['unsigned long long']], - 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64)]], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_209e' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], @@ -436,11 +436,11 @@ ntkrnlmp_types = { '_KIDTENTRY64' : [ 0x10, { 'OffsetLow' : [ 0x0, ['unsigned short']], 'Selector' : [ 0x2, ['unsigned short']], - 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'IstIndex' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned short')]], + 'Reserved0' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned short')]], + 'Type' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned short')]], + 'Dpl' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned short')]], + 'Present' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned short')]], 'OffsetMiddle' : [ 0x6, ['unsigned short']], 'OffsetHigh' : [ 0x8, ['unsigned long']], 'Reserved1' : [ 0xc, ['unsigned long']], @@ -470,10 +470,10 @@ ntkrnlmp_types = { 'FirmwareDescriptorListHead' : [ 0x60, ['_LIST_ENTRY']], 'AcpiTable' : [ 0x70, ['pointer64', ['void']]], 'AcpiTableSize' : [ 0x78, ['unsigned long']], - 'LastBootSucceeded' : [ 0x7c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LastBootShutdown' : [ 0x7c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IoPortAccessSupported' : [ 0x7c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x7c, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'LastBootSucceeded' : [ 0x7c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LastBootShutdown' : [ 0x7c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoPortAccessSupported' : [ 0x7c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x7c, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'LoaderPerformanceData' : [ 0x80, ['pointer64', ['_LOADER_PERFORMANCE_DATA']]], 'BootApplicationPersistentData' : [ 0x88, ['_LIST_ENTRY']], 'WmdTestResult' : [ 0x98, ['pointer64', ['void']]], @@ -520,8 +520,8 @@ ntkrnlmp_types = { 'RspOffset' : [ 0x30, ['unsigned long long']], 'Rip' : [ 0x38, ['unsigned long long']], 'FltSave' : [ 0x40, ['pointer64', ['_XSAVE_FORMAT']]], - 'Volatile' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 64)]], + 'Volatile' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x48, ['BitField', dict(start_bit = 1, end_bit = 64, native_type='unsigned long long')]], 'Flags' : [ 0x48, ['unsigned long long']], 'TrapFrame' : [ 0x50, ['pointer64', ['_KTRAP_FRAME']]], 'ExceptionFrame' : [ 0x58, ['pointer64', ['_KEXCEPTION_FRAME']]], @@ -565,11 +565,11 @@ ntkrnlmp_types = { 'PageCount' : [ 0x8, ['unsigned long long']], } ], '_RTL_SRWLOCK' : [ 0x8, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], 'Ptr' : [ 0x0, ['pointer64', ['void']]], } ], @@ -668,10 +668,10 @@ ntkrnlmp_types = { 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], } ], '_POOL_HEADER' : [ 0x10, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'BlockSize' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'PoolType' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'ProcessBilled' : [ 0x8, ['pointer64', ['_EPROCESS']]], @@ -689,12 +689,12 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['unsigned long long']], 'ImageBaseAddress' : [ 0x10, ['unsigned long long']], 'Ldr' : [ 0x18, ['unsigned long long']], @@ -705,12 +705,12 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x40, ['unsigned long long']], 'IFEOKey' : [ 0x48, ['unsigned long long']], 'CrossProcessFlags' : [ 0x50, ['unsigned long']], - 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32)]], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x58, ['unsigned long long']], 'UserSharedInfoPtr' : [ 0x58, ['unsigned long long']], 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], @@ -773,9 +773,9 @@ ntkrnlmp_types = { 'pContextData' : [ 0x368, ['unsigned long long']], 'pImageHeaderHash' : [ 0x370, ['unsigned long long']], 'TracingFlags' : [ 0x378, ['unsigned long']], - 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_SE_AUDIT_PROCESS_CREATION_INFO' : [ 0x8, { 'ImageFileName' : [ 0x0, ['pointer64', ['_OBJECT_NAME_INFORMATION']]], @@ -847,8 +847,8 @@ ntkrnlmp_types = { } ], '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x10, { 'Process' : [ 0x0, ['pointer64', ['_EPROCESS']]], - 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'HandleCount' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x8, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_CLIENT_ID' : [ 0x10, { 'UniqueProcess' : [ 0x0, ['pointer64', ['void']]], @@ -874,18 +874,18 @@ ntkrnlmp_types = { } ], '_KWAIT_STATUS_REGISTER' : [ 0x1, { 'Flags' : [ 0x0, ['unsigned char']], - 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Priority' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Apc' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Alert' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Apc' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Alert' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_VI_DEADLOCK_RESOURCE' : [ 0xf8, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockInStackQueuedSpinLock', 7: 'VfDeadlockUnusedSpinLock', 8: 'VfDeadlockEresource', 9: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer64', ['void']]], 'ThreadOwner' : [ 0x10, ['pointer64', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x18, ['_LIST_ENTRY']], @@ -903,33 +903,33 @@ ntkrnlmp_types = { 'Length' : [ 0x10, ['unsigned long']], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], } ], '_SECURITY_CLIENT_CONTEXT' : [ 0x48, { 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], @@ -1071,16 +1071,16 @@ ntkrnlmp_types = { 'BaseHigh' : [ 0x3, ['unsigned char']], } ], '__unnamed_21c2' : [ 0x4, { - 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'BaseMiddle' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Present' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHigh' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'LongMode' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'DefaultBig' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHigh' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_KGDTENTRY64' : [ 0x10, { 'LimitLow' : [ 0x0, ['unsigned short']], @@ -1184,9 +1184,9 @@ ntkrnlmp_types = { } ], '__unnamed_21e8' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { 'Revision' : [ 0x0, ['unsigned short']], @@ -1305,8 +1305,8 @@ ntkrnlmp_types = { 'ReasonSize' : [ 0x18, ['unsigned long long']], } ], '__unnamed_220b' : [ 0x4, { - 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_220d' : [ 0x4, { 'Flags' : [ 0x0, ['__unnamed_220b']], @@ -1379,10 +1379,10 @@ ntkrnlmp_types = { 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], 'Security' : [ 0x2c, ['unsigned long']], 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'MaxClassLen' : [ 0x38, ['unsigned long']], 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], 'MaxValueDataLen' : [ 0x40, ['unsigned long']], @@ -1417,10 +1417,10 @@ ntkrnlmp_types = { 'Offset' : [ 0x30, ['unsigned long']], 'Length' : [ 0x34, ['unsigned long']], 'Page' : [ 0x38, ['unsigned long long']], - 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'Spare' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'IoMapping' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x40, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x40, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Spare' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'CallingAddress' : [ 0x48, ['pointer64', ['void']]], 'CallersCaller' : [ 0x50, ['pointer64', ['void']]], } ], @@ -1574,18 +1574,18 @@ ntkrnlmp_types = { 'TimeRefreshLockAcquired' : [ 0x2f4, ['unsigned char']], } ], '_SEGMENT_FLAGS' : [ 0x4, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22)]], - 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'ContainsDebug' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22, native_type='unsigned long')]], + 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'ContainsDebug' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_VF_KE_CRITICAL_REGION_TRACE' : [ 0x40, { 'Thread' : [ 0x0, ['pointer64', ['_ETHREAD']]], @@ -1693,20 +1693,20 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], - 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0xfca, ['unsigned short']], - 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16)]], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], @@ -1795,22 +1795,22 @@ ntkrnlmp_types = { 'FileAttributes' : [ 0x30, ['unsigned long']], } ], '_WHEA_MEMORY_ERROR_SECTION_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '_RELATION_LIST_ENTRY' : [ 0x10, { @@ -1945,11 +1945,11 @@ ntkrnlmp_types = { 'PromotionCompletedEvent' : [ 0x2c0, ['_KEVENT']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], } ], '_CM_KCB_UOW' : [ 0x60, { 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -1974,16 +1974,16 @@ ntkrnlmp_types = { 'ThisVolatileKeyCell' : [ 0x58, ['unsigned long']], } ], '_MMPTE_TRANSITION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '_KREQUEST_PACKET' : [ 0x20, { 'CurrentPacket' : [ 0x0, ['array', 3, ['pointer64', ['void']]]], @@ -1998,16 +1998,16 @@ ntkrnlmp_types = { 'CancelTimeoutTicks' : [ 0x1e, ['unsigned short']], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], } ], '__unnamed_22df' : [ 0x8, { - 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48)]], - 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_22e1' : [ 0x8, { 's1' : [ 0x0, ['__unnamed_22df']], @@ -2034,19 +2034,19 @@ ntkrnlmp_types = { 'Count' : [ 0x18, ['unsigned long']], } ], '_MMSECURE_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12, native_type='unsigned long')]], } ], '_PO_IRP_QUEUE' : [ 0x10, { 'CurrentIrp' : [ 0x0, ['pointer64', ['_IRP']]], 'PendingIrpList' : [ 0x8, ['pointer64', ['_IRP']]], } ], '__unnamed_22f4' : [ 0x4, { - 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'Whole' : [ 0x0, ['unsigned long']], } ], '_VI_DEADLOCK_NODE' : [ 0xd0, { @@ -2136,24 +2136,24 @@ ntkrnlmp_types = { } ], '_WHEA_ERROR_STATUS' : [ 0x8, { 'ErrorStatus' : [ 0x0, ['unsigned long long']], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], } ], '_WHEA_PERSISTENCE_INFO' : [ 0x8, { - 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40)]], - 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56)]], - 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58)]], - 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64)]], + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], 'AsULONGLONG' : [ 0x0, ['unsigned long long']], } ], '_MI_SECTION_IMAGE_INFORMATION' : [ 0x48, { @@ -2215,11 +2215,11 @@ ntkrnlmp_types = { 'Machine' : [ 0x30, ['unsigned short']], 'ImageContainsCode' : [ 0x32, ['unsigned char']], 'ImageFlags' : [ 0x33, ['unsigned char']], - 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ComPlusNativeReady' : [ 0x33, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x33, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x33, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x33, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x33, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'LoaderFlags' : [ 0x34, ['unsigned long']], 'ImageFileSize' : [ 0x38, ['unsigned long']], 'CheckSum' : [ 0x3c, ['unsigned long']], @@ -2443,10 +2443,10 @@ ntkrnlmp_types = { 'ResumeContextPages' : [ 0x120, ['unsigned long']], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'BATTERY_REPORTING_SCALE' : [ 0x8, { @@ -2472,13 +2472,13 @@ ntkrnlmp_types = { 'FileRuns' : [ 0x50, ['unsigned long']], } ], '_DEVICE_FLAGS' : [ 0x4, { - 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], } ], '_RTL_BALANCED_LINKS' : [ 0x20, { 'Parent' : [ 0x0, ['pointer64', ['_RTL_BALANCED_LINKS']]], @@ -2489,21 +2489,21 @@ ntkrnlmp_types = { } ], '_MMVIEW' : [ 0x30, { 'Entry' : [ 0x0, ['unsigned long long']], - 'Writable' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Writable' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], 'ControlArea' : [ 0x8, ['pointer64', ['_CONTROL_AREA']]], 'ViewLinks' : [ 0x10, ['_LIST_ENTRY']], 'SessionViewVa' : [ 0x20, ['pointer64', ['void']]], 'SessionId' : [ 0x28, ['unsigned long']], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_HEADLESS_LOADER_BLOCK' : [ 0x40, { 'UsedBiosSettings' : [ 0x0, ['unsigned char']], @@ -2696,19 +2696,19 @@ ntkrnlmp_types = { 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], 'SafeBootMode' : [ 0x2ec, ['unsigned char']], 'TscQpcData' : [ 0x2ed, ['unsigned char']], - 'TscQpcEnabled' : [ 0x2ed, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'TscQpcSpareFlag' : [ 0x2ed, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'TscQpcShift' : [ 0x2ed, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'TscQpcEnabled' : [ 0x2ed, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TscQpcSpareFlag' : [ 0x2ed, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'TscQpcShift' : [ 0x2ed, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], 'TscQpcPad' : [ 0x2ee, ['array', 2, ['unsigned char']]], 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], - 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], 'DataFlagsPad' : [ 0x2f4, ['array', 1, ['unsigned long']]], 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], 'SystemCall' : [ 0x300, ['unsigned long']], @@ -2759,9 +2759,9 @@ ntkrnlmp_types = { 'QuadPart' : [ 0x0, ['long long']], } ], '__unnamed_105f' : [ 0x4, { - 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1061' : [ 0x4, { 'Flags' : [ 0x0, ['unsigned long']], @@ -2877,20 +2877,20 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0x17e0, ['pointer64', ['void']]], 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16)]], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0x17f0, ['pointer64', ['void']]], 'TxnScopeExitCallback' : [ 0x17f8, ['pointer64', ['void']]], 'TxnScopeContext' : [ 0x1800, ['pointer64', ['void']]], @@ -3082,7 +3082,7 @@ ntkrnlmp_types = { 'DpcRequestSummary' : [ 0x21dc, ['long']], 'DpcRequestSlot' : [ 0x21dc, ['array', 2, ['short']]], 'NormalDpcState' : [ 0x21dc, ['short']], - 'DpcThreadActive' : [ 0x21de, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'DpcThreadActive' : [ 0x21de, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], 'ThreadDpcState' : [ 0x21de, ['short']], 'TimerHand' : [ 0x21e0, ['unsigned long']], 'MasterOffset' : [ 0x21e4, ['long']], @@ -3257,21 +3257,21 @@ ntkrnlmp_types = { 'WaitRegister' : [ 0x48, ['_KWAIT_STATUS_REGISTER']], 'Running' : [ 0x49, ['unsigned char']], 'Alerted' : [ 0x4a, ['array', 2, ['unsigned char']]], - 'KernelStackResident' : [ 0x4c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadyTransition' : [ 0x4c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessReadyQueue' : [ 0x4c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WaitNext' : [ 0x4c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemAffinityActive' : [ 0x4c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Alertable' : [ 0x4c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'GdiFlushActive' : [ 0x4c, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'UserStackWalkActive' : [ 0x4c, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ApcInterruptRequest' : [ 0x4c, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'ForceDeferSchedule' : [ 0x4c, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'QuantumEndMigrate' : [ 0x4c, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'UmsDirectedSwitchEnable' : [ 0x4c, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'TimerActive' : [ 0x4c, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'SystemThread' : [ 0x4c, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'Reserved' : [ 0x4c, ['BitField', dict(start_bit = 14, end_bit = 32)]], + 'KernelStackResident' : [ 0x4c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x4c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessReadyQueue' : [ 0x4c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WaitNext' : [ 0x4c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x4c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Alertable' : [ 0x4c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GdiFlushActive' : [ 0x4c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x4c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ApcInterruptRequest' : [ 0x4c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ForceDeferSchedule' : [ 0x4c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'QuantumEndMigrate' : [ 0x4c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'UmsDirectedSwitchEnable' : [ 0x4c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'TimerActive' : [ 0x4c, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'SystemThread' : [ 0x4c, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Reserved' : [ 0x4c, ['BitField', dict(start_bit = 14, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x4c, ['long']], 'ApcState' : [ 0x50, ['_KAPC_STATE']], 'ApcStateFill' : [ 0x50, ['array', 43, ['unsigned char']]], @@ -3286,18 +3286,18 @@ ntkrnlmp_types = { 'Queue' : [ 0xb0, ['pointer64', ['_KQUEUE']]], 'Teb' : [ 0xb8, ['pointer64', ['void']]], 'Timer' : [ 0xc0, ['_KTIMER']], - 'AutoAlignment' : [ 0x100, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x100, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwStackTraceApc1Inserted' : [ 0x100, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EtwStackTraceApc2Inserted' : [ 0x100, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CalloutActive' : [ 0x100, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ApcQueueable' : [ 0x100, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'EnableStackSwap' : [ 0x100, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'GuiThread' : [ 0x100, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'UmsPerformingSyscall' : [ 0x100, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'VdmSafe' : [ 0x100, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'UmsDispatched' : [ 0x100, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ReservedFlags' : [ 0x100, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'AutoAlignment' : [ 0x100, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0x100, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'EtwStackTraceApc1Inserted' : [ 0x100, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EtwStackTraceApc2Inserted' : [ 0x100, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CalloutActive' : [ 0x100, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ApcQueueable' : [ 0x100, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0x100, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'GuiThread' : [ 0x100, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'UmsPerformingSyscall' : [ 0x100, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'VdmSafe' : [ 0x100, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'UmsDispatched' : [ 0x100, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x100, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], 'ThreadFlags' : [ 0x100, ['long']], 'Spare0' : [ 0x104, ['unsigned long']], 'WaitBlock' : [ 0x108, ['array', 4, ['_KWAIT_BLOCK']]], @@ -3325,8 +3325,8 @@ ntkrnlmp_types = { 'ApcStateIndex' : [ 0x1f0, ['unsigned char']], 'BasePriority' : [ 0x1f1, ['unsigned char']], 'PriorityDecrement' : [ 0x1f2, ['unsigned char']], - 'ForegroundBoost' : [ 0x1f2, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'UnusualBoost' : [ 0x1f2, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ForegroundBoost' : [ 0x1f2, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'UnusualBoost' : [ 0x1f2, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'Preempted' : [ 0x1f3, ['unsigned char']], 'AdjustReason' : [ 0x1f4, ['unsigned char']], 'AdjustIncrement' : [ 0x1f5, ['unsigned char']], @@ -3396,18 +3396,18 @@ ntkrnlmp_types = { 'YieldingParam' : [ 0x78, ['pointer64', ['void']]], 'UmsTeb' : [ 0x80, ['pointer64', ['void']]], 'PrimaryFlags' : [ 0x88, ['unsigned long']], - 'UmsContextHeaderReady' : [ 0x88, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'UmsContextHeaderReady' : [ 0x88, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], 'UmsAssociatedQueue' : [ 0x20, ['pointer64', ['_KQUEUE']]], 'UmsQueueListEntry' : [ 0x28, ['pointer64', ['_LIST_ENTRY']]], 'UmsContextHeader' : [ 0x30, ['pointer64', ['_KUMS_CONTEXT_HEADER']]], 'UmsWaitGate' : [ 0x38, ['_KGATE']], 'StagingArea' : [ 0x50, ['pointer64', ['void']]], 'Flags' : [ 0x58, ['long']], - 'UmsForceQueueTermination' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'UmsAssociatedQueueUsed' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'UmsThreadParked' : [ 0x58, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'UmsPrimaryDeliveredContext' : [ 0x58, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'UmsPerformingSingleStep' : [ 0x58, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'UmsForceQueueTermination' : [ 0x58, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'UmsAssociatedQueueUsed' : [ 0x58, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'UmsThreadParked' : [ 0x58, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'UmsPrimaryDeliveredContext' : [ 0x58, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'UmsPerformingSingleStep' : [ 0x58, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], 'TebSelector' : [ 0x90, ['unsigned short']], } ], '_KSPIN_LOCK_QUEUE' : [ 0x10, { @@ -3425,28 +3425,28 @@ ntkrnlmp_types = { 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], } ], '__unnamed_11cd' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 25)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 64)]], - 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 61)]], - 'Region' : [ 0x8, ['BitField', dict(start_bit = 61, end_bit = 64)]], + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 25, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 61, native_type='unsigned long long')]], + 'Region' : [ 0x8, ['BitField', dict(start_bit = 61, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_11d2' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], - 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Init' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_11d5' : [ 0x10, { - 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], - 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 4)]], - 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Depth' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Sequence' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='unsigned long long')]], + 'HeaderType' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned long long')]], + 'NextEntry' : [ 0x8, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], } ], '_SLIST_HEADER' : [ 0x10, { 'Alignment' : [ 0x0, ['unsigned long long']], @@ -3481,11 +3481,11 @@ ntkrnlmp_types = { 'Information' : [ 0x4, ['unsigned long']], } ], '_EX_PUSH_LOCK' : [ 0x8, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 64, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], 'Ptr' : [ 0x0, ['pointer64', ['void']]], } ], @@ -3527,7 +3527,7 @@ ntkrnlmp_types = { } ], '_EX_FAST_REF' : [ 0x8, { 'Object' : [ 0x0, ['pointer64', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long long')]], 'Value' : [ 0x0, ['unsigned long long']], } ], '_EX_PUSH_LOCK_WAIT_BLOCK' : [ 0x40, { @@ -3568,51 +3568,51 @@ ntkrnlmp_types = { 'ReadClusterSize' : [ 0x440, ['unsigned long']], 'MmLockOrdering' : [ 0x444, ['long']], 'CrossThreadFlags' : [ 0x448, ['unsigned long']], - 'Terminated' : [ 0x448, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ThreadInserted' : [ 0x448, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x448, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x448, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x448, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x448, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x448, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x448, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x448, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyTokenOnOpen' : [ 0x448, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ThreadIoPriority' : [ 0x448, ['BitField', dict(start_bit = 10, end_bit = 13)]], - 'ThreadPagePriority' : [ 0x448, ['BitField', dict(start_bit = 13, end_bit = 16)]], - 'RundownFail' : [ 0x448, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NeedsWorkingSetAging' : [ 0x448, ['BitField', dict(start_bit = 17, end_bit = 18)]], + 'Terminated' : [ 0x448, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x448, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x448, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x448, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x448, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x448, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x448, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x448, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x448, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x448, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x448, ['BitField', dict(start_bit = 10, end_bit = 13, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x448, ['BitField', dict(start_bit = 13, end_bit = 16, native_type='unsigned long')]], + 'RundownFail' : [ 0x448, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NeedsWorkingSetAging' : [ 0x448, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x44c, ['unsigned long']], - 'ActiveExWorker' : [ 0x44c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x44c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x44c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ClonedThread' : [ 0x44c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'KeyedEventInUse' : [ 0x44c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RateApcState' : [ 0x44c, ['BitField', dict(start_bit = 5, end_bit = 7)]], - 'SelfTerminate' : [ 0x44c, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveExWorker' : [ 0x44c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x44c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x44c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x44c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x44c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RateApcState' : [ 0x44c, ['BitField', dict(start_bit = 5, end_bit = 7, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x44c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x450, ['unsigned long']], - 'Spare' : [ 0x450, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'StartAddressInvalid' : [ 0x450, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwPageFaultCalloutActive' : [ 0x450, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x450, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x450, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemCacheWorkingSetExclusive' : [ 0x450, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemCacheWorkingSetShared' : [ 0x450, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x450, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x451, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsProcessAddressSpaceExclusive' : [ 0x451, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsProcessAddressSpaceShared' : [ 0x451, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SuppressSymbolLoad' : [ 0x451, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Prefetching' : [ 0x451, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsDynamicMemoryShared' : [ 0x451, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsChangeControlAreaExclusive' : [ 0x451, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsChangeControlAreaShared' : [ 0x451, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsPagedPoolWorkingSetExclusive' : [ 0x452, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsPagedPoolWorkingSetShared' : [ 0x452, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsSystemPtesWorkingSetExclusive' : [ 0x452, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsSystemPtesWorkingSetShared' : [ 0x452, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'TrimTrigger' : [ 0x452, ['BitField', dict(start_bit = 4, end_bit = 6)]], - 'Spare1' : [ 0x452, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'Spare' : [ 0x450, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x450, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EtwPageFaultCalloutActive' : [ 0x450, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x450, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x450, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetExclusive' : [ 0x450, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetShared' : [ 0x450, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x450, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x451, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceExclusive' : [ 0x451, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x451, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x451, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Prefetching' : [ 0x451, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsDynamicMemoryShared' : [ 0x451, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsChangeControlAreaExclusive' : [ 0x451, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsChangeControlAreaShared' : [ 0x451, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetExclusive' : [ 0x452, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetShared' : [ 0x452, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetExclusive' : [ 0x452, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetShared' : [ 0x452, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'TrimTrigger' : [ 0x452, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], + 'Spare1' : [ 0x452, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], 'PriorityRegionActive' : [ 0x453, ['unsigned char']], 'CacheManagerActive' : [ 0x454, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x455, ['unsigned char']], @@ -3647,7 +3647,7 @@ ntkrnlmp_types = { 'DebugPort' : [ 0x1f0, ['pointer64', ['void']]], 'ExceptionPortData' : [ 0x1f8, ['pointer64', ['void']]], 'ExceptionPortValue' : [ 0x1f8, ['unsigned long long']], - 'ExceptionPortState' : [ 0x1f8, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'ExceptionPortState' : [ 0x1f8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long long')]], 'ObjectTable' : [ 0x200, ['pointer64', ['_HANDLE_TABLE']]], 'Token' : [ 0x208, ['_EX_FAST_REF']], 'WorkingSetPage' : [ 0x210, ['unsigned long long']], @@ -3706,56 +3706,56 @@ ntkrnlmp_types = { 'HighestUserAddress' : [ 0x430, ['pointer64', ['void']]], 'ModifiedPageCount' : [ 0x438, ['unsigned long']], 'Flags2' : [ 0x43c, ['unsigned long']], - 'JobNotReallyActive' : [ 0x43c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AccountingFolded' : [ 0x43c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'NewProcessReported' : [ 0x43c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ExitProcessReported' : [ 0x43c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReportCommitChanges' : [ 0x43c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LastReportMemory' : [ 0x43c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ReportPhysicalPageChanges' : [ 0x43c, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'HandleTableRundown' : [ 0x43c, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'NeedsHandleRundown' : [ 0x43c, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RefTraceEnabled' : [ 0x43c, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'NumaAware' : [ 0x43c, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtectedProcess' : [ 0x43c, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'DefaultPagePriority' : [ 0x43c, ['BitField', dict(start_bit = 12, end_bit = 15)]], - 'PrimaryTokenFrozen' : [ 0x43c, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessVerifierTarget' : [ 0x43c, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'StackRandomizationDisabled' : [ 0x43c, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'AffinityPermanent' : [ 0x43c, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'AffinityUpdateEnable' : [ 0x43c, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'PropagateNode' : [ 0x43c, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'ExplicitAffinity' : [ 0x43c, ['BitField', dict(start_bit = 21, end_bit = 22)]], + 'JobNotReallyActive' : [ 0x43c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x43c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x43c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x43c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x43c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x43c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ReportPhysicalPageChanges' : [ 0x43c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'HandleTableRundown' : [ 0x43c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x43c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x43c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'NumaAware' : [ 0x43c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtectedProcess' : [ 0x43c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x43c, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x43c, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x43c, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x43c, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x43c, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x43c, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PropagateNode' : [ 0x43c, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'ExplicitAffinity' : [ 0x43c, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], 'Flags' : [ 0x440, ['unsigned long']], - 'CreateReported' : [ 0x440, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x440, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x440, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x440, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x440, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x440, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x440, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x440, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x440, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x440, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x440, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x440, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x440, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'DeprioritizeViews' : [ 0x440, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x440, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x440, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x440, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x440, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x440, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x440, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x440, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x440, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x440, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x440, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'CrossSessionCreate' : [ 0x440, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'ProcessInserted' : [ 0x440, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x440, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'ProcessSelfDelete' : [ 0x440, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'SetTimerResolutionLink' : [ 0x440, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x440, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x440, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x440, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x440, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x440, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x440, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x440, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x440, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x440, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x440, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x440, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x440, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x440, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x440, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x440, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x440, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x440, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x440, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x440, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x440, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x440, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x440, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x440, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x440, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x440, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x440, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x440, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x440, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SetTimerResolutionLink' : [ 0x440, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x444, ['long']], 'VadRoot' : [ 0x448, ['_MM_AVL_TABLE']], 'AlpcContext' : [ 0x488, ['_ALPC_PROCESS_CONTEXT']], @@ -3775,11 +3775,11 @@ ntkrnlmp_types = { 'ReadyListHead' : [ 0x70, ['_LIST_ENTRY']], 'SwapListEntry' : [ 0x80, ['_SINGLE_LIST_ENTRY']], 'ActiveProcessors' : [ 0x88, ['_KAFFINITY_EX']], - 'AutoAlignment' : [ 0xb0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xb0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0xb0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveGroupsMask' : [ 0xb0, ['BitField', dict(start_bit = 3, end_bit = 7)]], - 'ReservedFlags' : [ 0xb0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'AutoAlignment' : [ 0xb0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0xb0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0xb0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ActiveGroupsMask' : [ 0xb0, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xb0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='long')]], 'ProcessFlags' : [ 0xb0, ['long']], 'BasePriority' : [ 0xb4, ['unsigned char']], 'QuantumReset' : [ 0xb5, ['unsigned char']], @@ -4289,8 +4289,8 @@ ntkrnlmp_types = { 'Flags' : [ 0x4, ['unsigned char']], 'IsFastIoPossible' : [ 0x5, ['unsigned char']], 'Flags2' : [ 0x6, ['unsigned char']], - 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'Resource' : [ 0x8, ['pointer64', ['_ERESOURCE']]], 'PagingIoResource' : [ 0x10, ['pointer64', ['_ERESOURCE']]], 'AllocationSize' : [ 0x18, ['_LARGE_INTEGER']], @@ -4393,12 +4393,12 @@ ntkrnlmp_types = { 'e2' : [ 0x0, ['__unnamed_1534']], } ], '__unnamed_153e' : [ 0x8, { - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 52)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55)]], - 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 52, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 57, native_type='unsigned long long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 57, end_bit = 58, native_type='unsigned long long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 64, native_type='unsigned long long')]], } ], '_MMPFN' : [ 0x30, { 'u1' : [ 0x0, ['__unnamed_152f']], @@ -4487,10 +4487,10 @@ ntkrnlmp_types = { 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], 'WritableUserReferences' : [ 0x4, ['long']], - 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30)]], - 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30, native_type='unsigned long')]], + 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubsectionRoot' : [ 0x8, ['pointer64', ['_MM_SUBSECTION_AVL_TABLE']]], 'SeImageStub' : [ 0x8, ['pointer64', ['_MI_IMAGE_SECURITY_REFERENCE']]], } ], @@ -4516,8 +4516,8 @@ ntkrnlmp_types = { 'ViewList' : [ 0x70, ['_LIST_ENTRY']], } ], '_MM_STORE_KEY' : [ 0x8, { - 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 60)]], - 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 64)]], + 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 60, native_type='unsigned long long')]], + 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 60, end_bit = 64, native_type='unsigned long long')]], 'EntireKey' : [ 0x0, ['unsigned long long']], } ], '_MMPAGING_FILE' : [ 0x90, { @@ -4535,25 +4535,25 @@ ntkrnlmp_types = { 'BitmapHint' : [ 0x68, ['unsigned long']], 'LastAllocationSize' : [ 0x6c, ['unsigned long']], 'ToBeEvictedCount' : [ 0x70, ['unsigned long']], - 'PageFileNumber' : [ 0x74, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'BootPartition' : [ 0x74, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Spare0' : [ 0x74, ['BitField', dict(start_bit = 5, end_bit = 16)]], - 'AdriftMdls' : [ 0x76, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare1' : [ 0x76, ['BitField', dict(start_bit = 1, end_bit = 16)]], + 'PageFileNumber' : [ 0x74, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'BootPartition' : [ 0x74, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Spare0' : [ 0x74, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x76, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare1' : [ 0x76, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], 'FileHandle' : [ 0x78, ['pointer64', ['void']]], 'Lock' : [ 0x80, ['unsigned long long']], 'LockOwner' : [ 0x88, ['pointer64', ['_ETHREAD']]], } ], '_MM_AVL_TABLE' : [ 0x40, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'NodeHint' : [ 0x30, ['pointer64', ['void']]], 'NodeFreeHint' : [ 0x38, ['pointer64', ['void']]], } ], '__unnamed_15bf' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMVAD']]], } ], '__unnamed_15c2' : [ 0x8, { @@ -4575,7 +4575,7 @@ ntkrnlmp_types = { 'u5' : [ 0x38, ['__unnamed_15c5']], } ], '__unnamed_15cd' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x28, { @@ -4760,16 +4760,16 @@ ntkrnlmp_types = { } ], '_CM_KEY_CONTROL_BLOCK' : [ 0x128, { 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31)]], - 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31, native_type='unsigned long')]], + 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'KeyHash' : [ 0x10, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x10, ['unsigned long']], 'NextHash' : [ 0x18, ['pointer64', ['_CM_KEY_HASH']]], @@ -4793,10 +4793,10 @@ ntkrnlmp_types = { 'KcbMaxNameLen' : [ 0xb0, ['unsigned short']], 'KcbMaxValueNameLen' : [ 0xb2, ['unsigned short']], 'KcbMaxValueDataLen' : [ 0xb4, ['unsigned long']], - 'KcbUserFlags' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'KcbVirtControlFlags' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'KcbDebug' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Flags' : [ 0xb8, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'KcbUserFlags' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0xb8, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'RealKeyName' : [ 0xc0, ['pointer64', ['unsigned char']]], 'KCBUoWListHead' : [ 0xc8, ['_LIST_ENTRY']], 'DelayQueueEntry' : [ 0xd8, ['_LIST_ENTRY']], @@ -5680,12 +5680,12 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x8, ['pointer64', ['void']]], 'ImageBaseAddress' : [ 0x10, ['pointer64', ['void']]], 'Ldr' : [ 0x18, ['pointer64', ['_PEB_LDR_DATA']]], @@ -5696,12 +5696,12 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x40, ['pointer64', ['void']]], 'IFEOKey' : [ 0x48, ['pointer64', ['void']]], 'CrossProcessFlags' : [ 0x50, ['unsigned long']], - 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32)]], + 'ProcessInJob' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x50, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x50, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x58, ['pointer64', ['void']]], 'UserSharedInfoPtr' : [ 0x58, ['pointer64', ['void']]], 'SystemReserved' : [ 0x60, ['array', 1, ['unsigned long']]], @@ -5764,9 +5764,9 @@ ntkrnlmp_types = { 'pContextData' : [ 0x368, ['pointer64', ['void']]], 'pImageHeaderHash' : [ 0x370, ['pointer64', ['void']]], 'TracingFlags' : [ 0x378, ['unsigned long']], - 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'HeapTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x378, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x378, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_PEB_LDR_DATA' : [ 0x58, { 'Length' : [ 0x0, ['unsigned long']], @@ -5862,10 +5862,10 @@ ntkrnlmp_types = { 'LookasideIndex' : [ 0x30, ['unsigned long']], } ], '__unnamed_199e' : [ 0x1, { - 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], } ], '__unnamed_19a0' : [ 0x1, { 's1' : [ 0x0, ['__unnamed_199e']], @@ -5881,8 +5881,8 @@ ntkrnlmp_types = { 'Lock' : [ 0x18, ['_EX_PUSH_LOCK']], } ], '__unnamed_19b3' : [ 0x4, { - 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_19b5' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19b3']], @@ -5899,7 +5899,7 @@ ntkrnlmp_types = { 'RegionListHead' : [ 0x38, ['_LIST_ENTRY']], } ], '__unnamed_19bb' : [ 0x4, { - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], } ], '__unnamed_19bd' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19bb']], @@ -5917,9 +5917,9 @@ ntkrnlmp_types = { 'ReadWriteView' : [ 0x50, ['pointer64', ['_KALPC_VIEW']]], } ], '__unnamed_19c3' : [ 0x4, { - 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], } ], '__unnamed_19c5' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19c3']], @@ -5945,22 +5945,22 @@ ntkrnlmp_types = { 'HandleTable' : [ 0x28, ['_ALPC_HANDLE_TABLE']], } ], '__unnamed_19e1' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], } ], '__unnamed_19e3' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19e1']], @@ -6025,18 +6025,18 @@ ntkrnlmp_types = { 'CallbackId' : [ 0x14, ['unsigned long']], } ], '__unnamed_1a00' : [ 0x4, { - 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], } ], '__unnamed_1a02' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1a00']], @@ -6093,8 +6093,8 @@ ntkrnlmp_types = { 'HandleData' : [ 0x30, ['pointer64', ['_KALPC_HANDLE_DATA']]], } ], '__unnamed_1a41' : [ 0x4, { - 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_1a43' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1a41']], @@ -6286,23 +6286,23 @@ ntkrnlmp_types = { 'SecurityDescriptor' : [ 0x300, ['_EX_FAST_REF']], 'BufferSequenceNumber' : [ 0x308, ['long long']], 'Flags' : [ 0x310, ['unsigned long']], - 'Persistent' : [ 0x310, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoLogger' : [ 0x310, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'FsReady' : [ 0x310, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RealTime' : [ 0x310, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow' : [ 0x310, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelTrace' : [ 0x310, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'NoMoreEnable' : [ 0x310, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'StackTracing' : [ 0x310, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ErrorLogged' : [ 0x310, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RealtimeLoggerContextFreed' : [ 0x310, ['BitField', dict(start_bit = 9, end_bit = 10)]], + 'Persistent' : [ 0x310, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x310, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x310, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x310, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x310, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x310, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x310, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'StackTracing' : [ 0x310, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ErrorLogged' : [ 0x310, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RealtimeLoggerContextFreed' : [ 0x310, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], 'RequestFlag' : [ 0x314, ['unsigned long']], - 'RequestNewFie' : [ 0x314, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'RequestUpdateFile' : [ 0x314, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'RequestFlush' : [ 0x314, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RequestDisableRealtime' : [ 0x314, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RequestDisconnectConsumer' : [ 0x314, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RequestConnectConsumer' : [ 0x314, ['BitField', dict(start_bit = 5, end_bit = 6)]], + 'RequestNewFie' : [ 0x314, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RequestUpdateFile' : [ 0x314, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'RequestFlush' : [ 0x314, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RequestDisableRealtime' : [ 0x314, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequestDisconnectConsumer' : [ 0x314, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RequestConnectConsumer' : [ 0x314, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], 'HookIdMap' : [ 0x318, ['_RTL_BITMAP']], } ], '_ETW_LOGGER_HANDLE' : [ 0x1, { @@ -6352,8 +6352,8 @@ ntkrnlmp_types = { 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], 'LoggerId' : [ 0x8, ['unsigned short']], 'Level' : [ 0xa, ['unsigned char']], - 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_TRACE_ENABLE_CONTEXT' : [ 0x8, { 'LoggerId' : [ 0x0, ['unsigned short']], @@ -6501,8 +6501,8 @@ ntkrnlmp_types = { '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x8, { 'ImpersonationData' : [ 0x0, ['unsigned long long']], 'ImpersonationToken' : [ 0x0, ['pointer64', ['void']]], - 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], } ], '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], @@ -6513,14 +6513,14 @@ ntkrnlmp_types = { 'PpcControlSet' : [ 0x0, ['_PPC_DBGKD_CONTROL_SET']], } ], '_MMVAD_FLAGS3' : [ 0x8, { - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6)]], - 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24)]], - 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], - 'LargePageCreating' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33)]], - 'Spare3' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64)]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned long long')]], + 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24, native_type='unsigned long long')]], + 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long long')]], + 'LargePageCreating' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 33, native_type='unsigned long long')]], + 'Spare3' : [ 0x0, ['BitField', dict(start_bit = 33, end_bit = 64, native_type='unsigned long long')]], } ], '_MI_VERIFIER_POOL_HEADER' : [ 0x8, { 'VerifierPoolEntry' : [ 0x0, ['pointer64', ['_VI_POOL_ENTRY']]], @@ -6584,22 +6584,22 @@ ntkrnlmp_types = { 'Request' : [ 0x28, ['_PORT_MESSAGE']], } ], '_HARDWARE_PTE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'reserved0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_DUAL' : [ 0x278, { 'Length' : [ 0x0, ['unsigned long']], @@ -6635,35 +6635,35 @@ ntkrnlmp_types = { } ], '_KSTACK_COUNT' : [ 0x4, { 'Value' : [ 0x0, ['long']], - 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], } ], '_DISPATCHER_HEADER' : [ 0x18, { 'Type' : [ 0x0, ['unsigned char']], 'TimerControlFlags' : [ 0x1, ['unsigned char']], - 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Coalescable' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'KeepShifting' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Coalescable' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KeepShifting' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], 'Abandoned' : [ 0x1, ['unsigned char']], 'Signalling' : [ 0x1, ['unsigned char']], 'ThreadControlFlags' : [ 0x2, ['unsigned char']], - 'CpuThrottled' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'CpuThrottled' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], 'Hand' : [ 0x2, ['unsigned char']], 'Size' : [ 0x2, ['unsigned char']], 'TimerMiscFlags' : [ 0x3, ['unsigned char']], - 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 6)]], - 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned char')]], + 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], 'DebugActive' : [ 0x3, ['unsigned char']], - 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved2' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved2' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned char')]], + 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], 'DpcActive' : [ 0x3, ['unsigned char']], 'Lock' : [ 0x0, ['long']], 'SignalState' : [ 0x4, ['long']], @@ -6792,7 +6792,7 @@ ntkrnlmp_types = { 'DebugInfo' : [ 0x38, ['pointer64', ['_HANDLE_TRACE_DEBUG_INFO']]], 'ExtraInfoPages' : [ 0x40, ['long']], 'Flags' : [ 0x44, ['unsigned long']], - 'StrictFIFO' : [ 0x44, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x44, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], 'FirstFreeHandle' : [ 0x48, ['unsigned long']], 'LastFreeHandleEntry' : [ 0x50, ['pointer64', ['_HANDLE_TABLE_ENTRY']]], 'HandleCount' : [ 0x58, ['unsigned long']], @@ -6806,15 +6806,15 @@ ntkrnlmp_types = { 'NumberOfBytes' : [ 0x10, ['unsigned long long']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_TEB_ACTIVE_FRAME' : [ 0x18, { 'Flags' : [ 0x0, ['unsigned long']], @@ -6835,8 +6835,8 @@ ntkrnlmp_types = { 'NotifyBlock' : [ 0x10, ['pointer64', ['_CM_NOTIFY_BLOCK']]], 'ProcessID' : [ 0x18, ['pointer64', ['void']]], 'KeyBodyList' : [ 0x20, ['_LIST_ENTRY']], - 'Flags' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'HandleTags' : [ 0x30, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'Flags' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'HandleTags' : [ 0x30, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'KtmTrans' : [ 0x38, ['pointer64', ['void']]], 'KtmUow' : [ 0x40, ['pointer64', ['_GUID']]], 'ContextListHead' : [ 0x48, ['_LIST_ENTRY']], @@ -6852,22 +6852,22 @@ ntkrnlmp_types = { 'SpareLong' : [ 0x2c, ['long']], } ], '_MMPTE_PROTOTYPE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned long long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'ProtoAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_THERMAL_INFORMATION_EX' : [ 0x78, { @@ -6884,15 +6884,15 @@ ntkrnlmp_types = { 'S4TransitionTripPoint' : [ 0x74, ['unsigned long']], } ], '__unnamed_1c5c' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], } ], '__unnamed_1c5e' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], } ], '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { 'File' : [ 0x0, ['__unnamed_1c5c']], @@ -6904,14 +6904,14 @@ ntkrnlmp_types = { 'Parameters' : [ 0x10, ['array', 2, ['unsigned long long']]], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16)]], - 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16)]], + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], } ], '_EXCEPTION_POINTERS' : [ 0x10, { 'ExceptionRecord' : [ 0x0, ['pointer64', ['_EXCEPTION_RECORD']]], @@ -6979,9 +6979,9 @@ ntkrnlmp_types = { 'u4' : [ 0x88, ['__unnamed_1c85']], } ], '_MMWSLE_FREE_ENTRY' : [ 0x8, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], - 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_NT_TIB' : [ 0x38, { 'ExceptionList' : [ 0x0, ['pointer64', ['_EXCEPTION_REGISTRATION_RECORD']]], @@ -7044,10 +7044,10 @@ ntkrnlmp_types = { } ], '__unnamed_1c99' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_IDLE_STATES' : [ 0xa0, { 'Count' : [ 0x0, ['unsigned long']], @@ -7063,8 +7063,8 @@ ntkrnlmp_types = { 'PcatInformation' : [ 0x0, ['_PCAT_FIRMWARE_INFORMATION']], } ], '_FIRMWARE_INFORMATION_LOADER_BLOCK' : [ 0x20, { - 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'u' : [ 0x8, ['__unnamed_1ca2']], } ], '_HEAP_UCR_DESCRIPTOR' : [ 0x30, { @@ -7155,9 +7155,9 @@ ntkrnlmp_types = { 'PostList' : [ 0x10, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x20, ['pointer64', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x28, ['pointer64', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x30, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x30, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x30, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x38, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_KINTERRUPT' : [ 0xa0, { @@ -7315,22 +7315,22 @@ ntkrnlmp_types = { 'Lock' : [ 0x10, ['_EX_PUSH_LOCK']], } ], '_MMPTE_HARDWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48)]], - 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52)]], - 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63)]], - 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 48, native_type='unsigned long long')]], + 'reserved1' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 52, native_type='unsigned long long')]], + 'SoftwareWsIndex' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 63, native_type='unsigned long long')]], + 'NoExecute' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x10, { 'Port' : [ 0x0, ['pointer64', ['void']]], @@ -7453,13 +7453,13 @@ ntkrnlmp_types = { 'List' : [ 0x4, ['unsigned long']], } ], '_MMVAD_FLAGS' : [ 0x8, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 51, native_type='unsigned long long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 51, end_bit = 52, native_type='unsigned long long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 52, end_bit = 55, native_type='unsigned long long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 55, end_bit = 56, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 61, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 61, end_bit = 63, native_type='unsigned long long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 63, end_bit = 64, native_type='unsigned long long')]], } ], '_MMWSLE_HASH' : [ 0x4, { 'Index' : [ 0x0, ['unsigned long']], @@ -7498,10 +7498,10 @@ ntkrnlmp_types = { } ], '_VF_TRACKER_STAMP' : [ 0x10, { 'Thread' : [ 0x0, ['pointer64', ['void']]], - 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Flags' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x9, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0xa, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], } ], '_VI_TRACK_IRQL' : [ 0x38, { 'Thread' : [ 0x0, ['pointer64', ['void']]], @@ -7545,7 +7545,7 @@ ntkrnlmp_types = { '_XSTATE_CONFIGURATION' : [ 0x210, { 'EnabledFeatures' : [ 0x0, ['unsigned long long']], 'Size' : [ 0x8, ['unsigned long']], - 'OptimizedSave' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'OptimizedSave' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], 'Features' : [ 0x10, ['array', 64, ['_XSTATE_FEATURE']]], } ], '_CM_KEY_SECURITY_CACHE' : [ 0x38, { @@ -7557,36 +7557,36 @@ ntkrnlmp_types = { 'Descriptor' : [ 0x20, ['_SECURITY_DESCRIPTOR_RELATIVE']], } ], '_MMPTE_SOFTWARE' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22)]], - 'InStore' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 32)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'UsedPageTableEntries' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 22, native_type='unsigned long long')]], + 'InStore' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 32, native_type='unsigned long long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_RTL_UMS_CONTEXT' : [ 0x540, { 'Link' : [ 0x0, ['_SINGLE_LIST_ENTRY']], 'Context' : [ 0x10, ['_CONTEXT']], 'Teb' : [ 0x4e0, ['pointer64', ['void']]], 'UserContext' : [ 0x4e8, ['pointer64', ['void']]], - 'ScheduledThread' : [ 0x4f0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'HasQuantumReq' : [ 0x4f0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasAffinityReq' : [ 0x4f0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'HasPriorityReq' : [ 0x4f0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Suspended' : [ 0x4f0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VolatileContext' : [ 0x4f0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Terminated' : [ 0x4f0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'DebugActive' : [ 0x4f0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'DenyRunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ReservedFlags' : [ 0x4f0, ['BitField', dict(start_bit = 10, end_bit = 32)]], + 'ScheduledThread' : [ 0x4f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'HasQuantumReq' : [ 0x4f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HasAffinityReq' : [ 0x4f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'HasPriorityReq' : [ 0x4f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Suspended' : [ 0x4f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VolatileContext' : [ 0x4f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Terminated' : [ 0x4f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'DebugActive' : [ 0x4f0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DenyRunningOnSelfThread' : [ 0x4f0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x4f0, ['BitField', dict(start_bit = 10, end_bit = 32, native_type='unsigned long')]], 'Flags' : [ 0x4f0, ['long']], - 'KernelUpdateLock' : [ 0x4f8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x4f8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PrimaryClientID' : [ 0x4f8, ['BitField', dict(start_bit = 2, end_bit = 64)]], + 'KernelUpdateLock' : [ 0x4f8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Reserved' : [ 0x4f8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PrimaryClientID' : [ 0x4f8, ['BitField', dict(start_bit = 2, end_bit = 64, native_type='unsigned long long')]], 'ContextLock' : [ 0x4f8, ['unsigned long long']], 'QuantumValue' : [ 0x500, ['unsigned long long']], 'AffinityMask' : [ 0x508, ['_GROUP_AFFINITY']], @@ -7612,9 +7612,9 @@ ntkrnlmp_types = { } ], '_MM_SUBSECTION_AVL_TABLE' : [ 0x38, { 'BalancedRoot' : [ 0x0, ['_MMSUBSECTION_NODE']], - 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'DepthOfTree' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long long')]], + 'Unused' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long long')]], + 'NumberGenericTableElements' : [ 0x28, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='unsigned long long')]], 'NodeHint' : [ 0x30, ['pointer64', ['void']]], } ], '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { @@ -7626,13 +7626,13 @@ ntkrnlmp_types = { 'PartialResourceList' : [ 0x8, ['_CM_PARTIAL_RESOURCE_LIST']], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { - 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_WMI_BUFFER_HEADER' : [ 0x48, { @@ -7702,17 +7702,17 @@ ntkrnlmp_types = { 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], - 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEGMENT_OBJECT' : [ 0x40, { 'BaseAddress' : [ 0x0, ['pointer64', ['void']]], @@ -7756,21 +7756,21 @@ ntkrnlmp_types = { 'DataLength' : [ 0x10, ['unsigned long']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], } ], '_IMAGE_OPTIONAL_HEADER64' : [ 0xf0, { 'Magic' : [ 0x0, ['unsigned short']], @@ -7942,20 +7942,20 @@ ntkrnlmp_types = { 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16)]], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], @@ -8018,9 +8018,9 @@ ntkrnlmp_types = { } ], '_OWNER_ENTRY' : [ 0x10, { 'OwnerThread' : [ 0x0, ['unsigned long long']], - 'IoPriorityBoosted' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnerReferenced' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnerCount' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'IoPriorityBoosted' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OwnerReferenced' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OwnerCount' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'TableSize' : [ 0x8, ['unsigned long']], } ], '_MI_SECTION_CREATION_GATE' : [ 0x20, { @@ -8148,26 +8148,26 @@ ntkrnlmp_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -8277,14 +8277,14 @@ ntkrnlmp_types = { 'Metrics' : [ 0x150, ['_POP_THERMAL_ZONE_METRICS']], } ], '_MMPTE_LIST' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_VI_POOL_PAGE_HEADER' : [ 0x18, { 'NextPage' : [ 0x0, ['pointer64', ['_SLIST_ENTRY']]], @@ -8330,10 +8330,10 @@ ntkrnlmp_types = { 'HiveArray' : [ 0x70, ['array', 7, ['pointer64', ['_CMHIVE']]]], } ], '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { - 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x1c, { @@ -8388,8 +8388,8 @@ ntkrnlmp_types = { 'PolicySetStatus' : [ 0x1b, ['unsigned char']], } ], '__unnamed_1ec2' : [ 0x4, { - 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1ec4' : [ 0x18, { 'AllSharedExportThunks' : [ 0x0, ['_VF_TARGET_ALL_SHARED_EXPORT_THUNKS']], @@ -8467,13 +8467,13 @@ ntkrnlmp_types = { 'BaseName' : [ 0x18, ['_UNICODE_STRING']], } ], '_MMPTE_TIMESTAMP' : [ 0x8, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], - 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 64, native_type='unsigned long long')]], } ], '_SID_AND_ATTRIBUTES_HASH' : [ 0x110, { 'SidCount' : [ 0x0, ['unsigned long']], @@ -8523,8 +8523,8 @@ ntkrnlmp_types = { 'SessionId' : [ 0x10, ['unsigned long']], 'CpuShareWeight' : [ 0x14, ['unsigned long']], 'CapturedWeightData' : [ 0x18, ['_PSP_CPU_SHARE_CAPTURED_WEIGHT_DATA']], - 'DuplicateInputMarker' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'DuplicateInputMarker' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x20, ['long']], 'BlockCurrentGenerationLock' : [ 0x0, ['unsigned long long']], 'CyclesAccumulated' : [ 0x8, ['unsigned long long']], @@ -8536,10 +8536,10 @@ ntkrnlmp_types = { } ], '__unnamed_1efc' : [ 0x1, { 'AsUCHAR' : [ 0x0, ['unsigned char']], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], } ], 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { 'Revision' : [ 0x0, ['unsigned long']], @@ -8569,29 +8569,29 @@ ntkrnlmp_types = { 'DeviceListHead' : [ 0x8, ['_LIST_ENTRY']], 'Lock' : [ 0x18, ['unsigned long long']], 'Busy' : [ 0x20, ['unsigned char']], - 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64)]], + 'Reserved' : [ 0x20, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='long long')]], + 'Hint' : [ 0x20, ['BitField', dict(start_bit = 8, end_bit = 64, native_type='long long')]], } ], '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'ContextAsUlong' : [ 0x0, ['unsigned long']], } ], '_OBJECT_TYPE_INITIALIZER' : [ 0x70, { 'Length' : [ 0x0, ['unsigned short']], 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], - 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], 'ObjectTypeCode' : [ 0x4, ['unsigned long']], 'InvalidAttributes' : [ 0x8, ['unsigned long']], 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], @@ -8656,14 +8656,14 @@ ntkrnlmp_types = { 'ActualLimit' : [ 0x20, ['unsigned long long']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], 'ExecuteOptions' : [ 0x0, ['unsigned char']], } ], '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { @@ -8697,13 +8697,13 @@ ntkrnlmp_types = { 'Reserved' : [ 0xc, ['unsigned long']], } ], '_MMWSLENTRY' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 64, native_type='unsigned long long')]], } ], '_DBGKD_SWITCH_PARTITION' : [ 0x4, { 'Partition' : [ 0x0, ['unsigned long']], @@ -8737,15 +8737,15 @@ ntkrnlmp_types = { 'Exchg' : [ 0x0, ['long long']], } ], '_WHEA_TIMESTAMP' : [ 0x8, { - 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32)]], - 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40)]], - 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48)]], - 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56)]], - 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64)]], + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], } ], '_PEB32' : [ 0x248, { @@ -8753,12 +8753,12 @@ ntkrnlmp_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['unsigned long']], 'ImageBaseAddress' : [ 0x8, ['unsigned long']], 'Ldr' : [ 0xc, ['unsigned long']], @@ -8769,12 +8769,12 @@ ntkrnlmp_types = { 'AtlThunkSListPtr' : [ 0x20, ['unsigned long']], 'IFEOKey' : [ 0x24, ['unsigned long']], 'CrossProcessFlags' : [ 0x28, ['unsigned long']], - 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32)]], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x2c, ['unsigned long']], 'UserSharedInfoPtr' : [ 0x2c, ['unsigned long']], 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], @@ -8837,9 +8837,9 @@ ntkrnlmp_types = { 'pContextData' : [ 0x238, ['unsigned long']], 'pImageHeaderHash' : [ 0x23c, ['unsigned long']], 'TracingFlags' : [ 0x240, ['unsigned long']], - 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_VPB' : [ 0x60, { 'Type' : [ 0x0, ['short']], @@ -8873,9 +8873,9 @@ ntkrnlmp_types = { 'ProcessAuditId' : [ 0x18, ['pointer64', ['void']]], } ], '_KBUGCHECK_ACTIVE_STATE' : [ 0x4, { - 'BugCheckState' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'RecursionCount' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'BugCheckOwner' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'BugCheckState' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'RecursionCount' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'BugCheckOwner' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['long']], } ], '_PF_KERNEL_GLOBALS' : [ 0x60, { @@ -8930,12 +8930,12 @@ ntkrnlmp_types = { 'HandleAttributes' : [ 0x20, ['unsigned long']], } ], '_MMPTE_SUBSECTION' : [ 0x8, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16)]], - 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'Unused0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned long long')]], + 'SubsectionAddress' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 64, native_type='long long')]], } ], '_POWER_STATE' : [ 0x4, { 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], @@ -9052,7 +9052,7 @@ ntkrnlmp_types = { 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], } ], '__unnamed_1fd3' : [ 0x8, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long long')]], 'Parent' : [ 0x0, ['pointer64', ['_MMSUBSECTION_NODE']]], } ], '_MMSUBSECTION_NODE' : [ 0x28, { @@ -9095,9 +9095,9 @@ ntkrnlmp_types = { 'AllocateFrom' : [ 0x10, ['pointer64', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { - 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], 'AsUCHAR' : [ 0x0, ['unsigned char']], } ], '_FS_FILTER_CALLBACKS' : [ 0x68, { diff --git a/volatility/plugins/overlays/windows/win7_sp1_x86_vtypes.py b/volatility/plugins/overlays/windows/win7_sp1_x86_vtypes.py index 02d3e05f..6e163841 100644 --- a/volatility/plugins/overlays/windows/win7_sp1_x86_vtypes.py +++ b/volatility/plugins/overlays/windows/win7_sp1_x86_vtypes.py @@ -1,4 +1,4 @@ -nt_types = { +ntkrnlmp_types = { '_u' : [ 0x50, { 'KeyNode' : [ 0x0, ['_CM_KEY_NODE']], 'KeyValue' : [ 0x0, ['_CM_KEY_VALUE']], @@ -38,9 +38,9 @@ nt_types = { } ], '__unnamed_200a' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_PERF_STATES' : [ 0x80, { 'Count' : [ 0x0, ['unsigned long']], @@ -188,10 +188,10 @@ nt_types = { '_IMAGE_SECURITY_CONTEXT' : [ 0x4, { 'PageHashes' : [ 0x0, ['pointer', ['void']]], 'Value' : [ 0x0, ['unsigned long']], - 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'SecurityBeingCreated' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SecurityMandatory' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PageHashPointer' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_204d' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], @@ -266,10 +266,10 @@ nt_types = { 'FirmwareDescriptorListHead' : [ 0x40, ['_LIST_ENTRY']], 'AcpiTable' : [ 0x48, ['pointer', ['void']]], 'AcpiTableSize' : [ 0x4c, ['unsigned long']], - 'LastBootSucceeded' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LastBootShutdown' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IoPortAccessSupported' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'LastBootSucceeded' : [ 0x50, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LastBootShutdown' : [ 0x50, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'IoPortAccessSupported' : [ 0x50, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x50, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'LoaderPerformanceData' : [ 0x54, ['pointer', ['_LOADER_PERFORMANCE_DATA']]], 'BootApplicationPersistentData' : [ 0x58, ['_LIST_ENTRY']], 'WmdTestResult' : [ 0x60, ['pointer', ['void']]], @@ -343,11 +343,11 @@ nt_types = { 'PageCount' : [ 0x4, ['unsigned long']], } ], '_RTL_SRWLOCK' : [ 0x4, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -417,10 +417,10 @@ nt_types = { 'OverThrottled' : [ 0xdc, ['POWER_ACTION_POLICY']], } ], '_POOL_HEADER' : [ 0x8, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16)]], - 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'PoolTag' : [ 0x4, ['unsigned long']], 'AllocatorBackTraceIndex' : [ 0x4, ['unsigned short']], @@ -499,8 +499,8 @@ nt_types = { } ], '_OBJECT_HANDLE_COUNT_ENTRY' : [ 0x8, { 'Process' : [ 0x0, ['pointer', ['_EPROCESS']]], - 'HandleCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'LockCount' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'HandleCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'LockCount' : [ 0x4, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_CLIENT_ID' : [ 0x8, { 'UniqueProcess' : [ 0x0, ['pointer', ['void']]], @@ -526,18 +526,18 @@ nt_types = { } ], '_KWAIT_STATUS_REGISTER' : [ 0x1, { 'Flags' : [ 0x0, ['unsigned char']], - 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Priority' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Apc' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Alert' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned char')]], + 'Affinity' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Priority' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Apc' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'UserApc' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Alert' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_VI_DEADLOCK_RESOURCE' : [ 0x80, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockMutexAbandoned', 3: 'VfDeadlockFastMutex', 4: 'VfDeadlockFastMutexUnsafe', 5: 'VfDeadlockSpinLock', 6: 'VfDeadlockInStackQueuedSpinLock', 7: 'VfDeadlockUnusedSpinLock', 8: 'VfDeadlockEresource', 9: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer', ['void']]], 'ThreadOwner' : [ 0xc, ['pointer', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x10, ['_LIST_ENTRY']], @@ -555,33 +555,33 @@ nt_types = { 'Length' : [ 0x10, ['unsigned long']], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 32, native_type='unsigned long')]], } ], '_SECURITY_CLIENT_CONTEXT' : [ 0x3c, { 'SecurityQos' : [ 0x0, ['_SECURITY_QUALITY_OF_SERVICE']], @@ -799,9 +799,9 @@ nt_types = { } ], '__unnamed_217b' : [ 0x2, { 'AsUSHORT' : [ 0x0, ['unsigned short']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 16, native_type='unsigned short')]], } ], 'PROCESSOR_IDLESTATE_POLICY' : [ 0x20, { 'Revision' : [ 0x0, ['unsigned short']], @@ -920,8 +920,8 @@ nt_types = { 'ReasonSize' : [ 0xc, ['unsigned long']], } ], '__unnamed_219e' : [ 0x4, { - 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'MissedEtwRegistration' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_21a0' : [ 0x4, { 'Flags' : [ 0x0, ['__unnamed_219e']], @@ -994,10 +994,10 @@ nt_types = { 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], 'Security' : [ 0x2c, ['unsigned long']], 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'MaxClassLen' : [ 0x38, ['unsigned long']], 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], 'MaxValueDataLen' : [ 0x40, ['unsigned long']], @@ -1032,10 +1032,10 @@ nt_types = { 'Offset' : [ 0x18, ['unsigned long']], 'Length' : [ 0x1c, ['unsigned long']], 'Page' : [ 0x20, ['unsigned long']], - 'IoMapping' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Matched' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CacheAttribute' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 4)]], - 'Spare' : [ 0x24, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'IoMapping' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Matched' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 4, native_type='unsigned long')]], + 'Spare' : [ 0x24, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'CallingAddress' : [ 0x28, ['pointer', ['void']]], 'CallersCaller' : [ 0x2c, ['pointer', ['void']]], } ], @@ -1184,18 +1184,18 @@ nt_types = { 'TimeRefreshLockAcquired' : [ 0x1a4, ['unsigned char']], } ], '_SEGMENT_FLAGS' : [ 0x4, { - 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10)]], - 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22)]], - 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'ContainsDebug' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'TotalNumberOfPtes4132' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 10, native_type='unsigned long')]], + 'ExtraSharedWowSubsections' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WatchProto' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'WriteCombined' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'DefaultProtectionMask' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 22, native_type='unsigned long')]], + 'Binary32' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'ContainsDebug' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_VF_KE_CRITICAL_REGION_TRACE' : [ 0x20, { 'Thread' : [ 0x0, ['pointer', ['_ETHREAD']]], @@ -1304,22 +1304,22 @@ nt_types = { 'FileAttributes' : [ 0x30, ['unsigned long']], } ], '_WHEA_MEMORY_ERROR_SECTION_VALIDBITS' : [ 0x8, { - 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64)]], + 'ErrorStatus' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long long')]], + 'PhysicalAddress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long long')]], + 'PhysicalAddressMask' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long long')]], + 'Node' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long long')]], + 'Card' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long long')]], + 'Module' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long long')]], + 'Bank' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long long')]], + 'Device' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long long')]], + 'Row' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long long')]], + 'Column' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long long')]], + 'BitPosition' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long long')]], + 'RequesterId' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long long')]], + 'ResponderId' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long long')]], + 'TargetId' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 64, native_type='unsigned long long')]], 'ValidBits' : [ 0x0, ['unsigned long long']], } ], '_RELATION_LIST_ENTRY' : [ 0xc, { @@ -1413,9 +1413,9 @@ nt_types = { '_VF_BTS_RECORD' : [ 0xc, { 'JumpedFrom' : [ 0x0, ['pointer', ['void']]], 'JumpedTo' : [ 0x4, ['pointer', ['void']]], - 'Unused1' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Predicted' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 7)]], - 'Unused2' : [ 0x8, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Unused1' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Predicted' : [ 0x8, ['BitField', dict(start_bit = 3, end_bit = 7, native_type='unsigned long')]], + 'Unused2' : [ 0x8, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_KTRANSACTION' : [ 0x1e0, { 'OutcomeEvent' : [ 0x0, ['_KEVENT']], @@ -1461,11 +1461,11 @@ nt_types = { 'PromotionCompletedEvent' : [ 0x1cc, ['_KEVENT']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'PagePriority' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 21, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 32, native_type='unsigned long')]], } ], '_CM_KCB_UOW' : [ 0x38, { 'TransactionListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -1494,15 +1494,15 @@ nt_types = { 'SpecialRegisters' : [ 0x2cc, ['_KSPECIAL_REGISTERS']], } ], '_MMPTE_TRANSITION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_VF_WATCHDOG_IRP' : [ 0x14, { 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], @@ -1513,16 +1513,16 @@ nt_types = { 'CancelTimeoutTicks' : [ 0x12, ['unsigned short']], } ], '_flags' : [ 0x1, { - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'GroupAssigned' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'GroupCommitted' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'GroupAssignmentFixed' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Fill' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], } ], '__unnamed_2272' : [ 0x8, { - 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48)]], - 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64)]], + 'Head' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long long')]], + 'Tail' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 48, native_type='unsigned long long')]], + 'ActiveThreadCount' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 64, native_type='unsigned long long')]], } ], '__unnamed_2274' : [ 0x8, { 's1' : [ 0x0, ['__unnamed_2272']], @@ -1549,19 +1549,19 @@ nt_types = { 'Count' : [ 0x18, ['unsigned long']], } ], '_MMSECURE_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 12, native_type='unsigned long')]], } ], '_PO_IRP_QUEUE' : [ 0x8, { 'CurrentIrp' : [ 0x0, ['pointer', ['_IRP']]], 'PendingIrpList' : [ 0x4, ['pointer', ['_IRP']]], } ], '__unnamed_2287' : [ 0x4, { - 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Active' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ReleasedOutOfOrder' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'Whole' : [ 0x0, ['unsigned long']], } ], '_VI_DEADLOCK_NODE' : [ 0x6c, { @@ -1651,24 +1651,24 @@ nt_types = { } ], '_WHEA_ERROR_STATUS' : [ 0x8, { 'ErrorStatus' : [ 0x0, ['unsigned long long']], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'ErrorType' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Address' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long long')]], + 'Control' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long long')]], + 'Data' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long long')]], + 'Responder' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long long')]], + 'Requester' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long long')]], + 'FirstError' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long long')]], + 'Overflow' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 64, native_type='unsigned long long')]], } ], '_WHEA_PERSISTENCE_INFO' : [ 0x8, { - 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40)]], - 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56)]], - 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58)]], - 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64)]], + 'Signature' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long long')]], + 'Length' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 40, native_type='unsigned long long')]], + 'Identifier' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 56, native_type='unsigned long long')]], + 'Attributes' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 58, native_type='unsigned long long')]], + 'DoNotLog' : [ 0x0, ['BitField', dict(start_bit = 58, end_bit = 59, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 59, end_bit = 64, native_type='unsigned long long')]], 'AsULONGLONG' : [ 0x0, ['unsigned long long']], } ], '_MI_SECTION_IMAGE_INFORMATION' : [ 0x38, { @@ -1725,11 +1725,11 @@ nt_types = { 'Machine' : [ 0x20, ['unsigned short']], 'ImageContainsCode' : [ 0x22, ['unsigned char']], 'ImageFlags' : [ 0x23, ['unsigned char']], - 'ComPlusNativeReady' : [ 0x23, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ComPlusILOnly' : [ 0x23, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ImageDynamicallyRelocated' : [ 0x23, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ImageMappedFlat' : [ 0x23, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x23, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ComPlusNativeReady' : [ 0x23, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ComPlusILOnly' : [ 0x23, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ImageDynamicallyRelocated' : [ 0x23, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'ImageMappedFlat' : [ 0x23, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Reserved' : [ 0x23, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'LoaderFlags' : [ 0x24, ['unsigned long']], 'ImageFileSize' : [ 0x28, ['unsigned long']], 'CheckSum' : [ 0x2c, ['unsigned long']], @@ -1938,10 +1938,10 @@ nt_types = { 'ResumeContextPages' : [ 0xdc, ['unsigned long']], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'BATTERY_REPORTING_SCALE' : [ 0x8, { @@ -1967,13 +1967,13 @@ nt_types = { 'FileRuns' : [ 0x50, ['unsigned long']], } ], '_DEVICE_FLAGS' : [ 0x4, { - 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'Failed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Removable' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ConsoleIn' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConsoleOut' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Input' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Output' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], } ], '_RTL_BALANCED_LINKS' : [ 0x10, { 'Parent' : [ 0x0, ['pointer', ['_RTL_BALANCED_LINKS']]], @@ -1984,21 +1984,21 @@ nt_types = { } ], '_MMVIEW' : [ 0x18, { 'Entry' : [ 0x0, ['unsigned long']], - 'Writable' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Writable' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], 'ControlArea' : [ 0x4, ['pointer', ['_CONTROL_AREA']]], 'ViewLinks' : [ 0x8, ['_LIST_ENTRY']], 'SessionViewVa' : [ 0x10, ['pointer', ['void']]], 'SessionId' : [ 0x14, ['unsigned long']], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PoolInitialized' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DynamicVaInitialized' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WsInitialized' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PoolDestroyed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ObjectInitialized' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], } ], '_HEADLESS_LOADER_BLOCK' : [ 0x34, { 'UsedBiosSettings' : [ 0x0, ['unsigned char']], @@ -2213,19 +2213,19 @@ nt_types = { 'NumberOfPhysicalPages' : [ 0x2e8, ['unsigned long']], 'SafeBootMode' : [ 0x2ec, ['unsigned char']], 'TscQpcData' : [ 0x2ed, ['unsigned char']], - 'TscQpcEnabled' : [ 0x2ed, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'TscQpcSpareFlag' : [ 0x2ed, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'TscQpcShift' : [ 0x2ed, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'TscQpcEnabled' : [ 0x2ed, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TscQpcSpareFlag' : [ 0x2ed, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'TscQpcShift' : [ 0x2ed, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], 'TscQpcPad' : [ 0x2ee, ['array', 2, ['unsigned char']]], 'SharedDataFlags' : [ 0x2f0, ['unsigned long']], - 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32)]], + 'DbgErrorPortPresent' : [ 0x2f0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DbgElevationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'DbgVirtEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'DbgInstallerDetectEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'DbgSystemDllRelocated' : [ 0x2f0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DbgDynProcessorEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'DbgSEHValidationEnabled' : [ 0x2f0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SpareBits' : [ 0x2f0, ['BitField', dict(start_bit = 7, end_bit = 32, native_type='unsigned long')]], 'DataFlagsPad' : [ 0x2f4, ['array', 1, ['unsigned long']]], 'TestRetInstruction' : [ 0x2f8, ['unsigned long long']], 'SystemCall' : [ 0x300, ['unsigned long']], @@ -2276,9 +2276,9 @@ nt_types = { 'QuadPart' : [ 0x0, ['long long']], } ], '__unnamed_105e' : [ 0x4, { - 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'LongFunction' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Persistent' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Private' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1060' : [ 0x4, { 'Flags' : [ 0x0, ['unsigned long']], @@ -2392,20 +2392,20 @@ nt_types = { 'MergedPrefLanguages' : [ 0xfc0, ['pointer', ['void']]], 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], - 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0xfca, ['unsigned short']], - 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16)]], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0xfcc, ['pointer', ['void']]], 'TxnScopeExitCallback' : [ 0xfd0, ['pointer', ['void']]], 'TxnScopeContext' : [ 0xfd4, ['pointer', ['void']]], @@ -2637,7 +2637,7 @@ nt_types = { 'DpcRequestSummary' : [ 0x1934, ['long']], 'DpcRequestSlot' : [ 0x1934, ['array', 2, ['short']]], 'NormalDpcState' : [ 0x1934, ['short']], - 'DpcThreadActive' : [ 0x1936, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'DpcThreadActive' : [ 0x1936, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], 'ThreadDpcState' : [ 0x1936, ['short']], 'TimerHand' : [ 0x1938, ['unsigned long']], 'LastTick' : [ 0x193c, ['unsigned long']], @@ -2794,21 +2794,21 @@ nt_types = { 'WaitRegister' : [ 0x38, ['_KWAIT_STATUS_REGISTER']], 'Running' : [ 0x39, ['unsigned char']], 'Alerted' : [ 0x3a, ['array', 2, ['unsigned char']]], - 'KernelStackResident' : [ 0x3c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadyTransition' : [ 0x3c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessReadyQueue' : [ 0x3c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WaitNext' : [ 0x3c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemAffinityActive' : [ 0x3c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Alertable' : [ 0x3c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'GdiFlushActive' : [ 0x3c, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'UserStackWalkActive' : [ 0x3c, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ApcInterruptRequest' : [ 0x3c, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'ForceDeferSchedule' : [ 0x3c, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'QuantumEndMigrate' : [ 0x3c, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'UmsDirectedSwitchEnable' : [ 0x3c, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'TimerActive' : [ 0x3c, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'SystemThread' : [ 0x3c, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'Reserved' : [ 0x3c, ['BitField', dict(start_bit = 14, end_bit = 32)]], + 'KernelStackResident' : [ 0x3c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadyTransition' : [ 0x3c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessReadyQueue' : [ 0x3c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WaitNext' : [ 0x3c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemAffinityActive' : [ 0x3c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Alertable' : [ 0x3c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'GdiFlushActive' : [ 0x3c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'UserStackWalkActive' : [ 0x3c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ApcInterruptRequest' : [ 0x3c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'ForceDeferSchedule' : [ 0x3c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'QuantumEndMigrate' : [ 0x3c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'UmsDirectedSwitchEnable' : [ 0x3c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'TimerActive' : [ 0x3c, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'SystemThread' : [ 0x3c, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'Reserved' : [ 0x3c, ['BitField', dict(start_bit = 14, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x3c, ['long']], 'ApcState' : [ 0x40, ['_KAPC_STATE']], 'ApcStateFill' : [ 0x40, ['array', 23, ['unsigned char']]], @@ -2832,18 +2832,18 @@ nt_types = { 'CombinedApcDisable' : [ 0x84, ['unsigned long']], 'Teb' : [ 0x88, ['pointer', ['void']]], 'Timer' : [ 0x90, ['_KTIMER']], - 'AutoAlignment' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0xb8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwStackTraceApc1Inserted' : [ 0xb8, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EtwStackTraceApc2Inserted' : [ 0xb8, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CalloutActive' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ApcQueueable' : [ 0xb8, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'EnableStackSwap' : [ 0xb8, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'GuiThread' : [ 0xb8, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'UmsPerformingSyscall' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'VdmSafe' : [ 0xb8, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'UmsDispatched' : [ 0xb8, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ReservedFlags' : [ 0xb8, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'AutoAlignment' : [ 0xb8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DisableBoost' : [ 0xb8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'EtwStackTraceApc1Inserted' : [ 0xb8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EtwStackTraceApc2Inserted' : [ 0xb8, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CalloutActive' : [ 0xb8, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ApcQueueable' : [ 0xb8, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'EnableStackSwap' : [ 0xb8, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'GuiThread' : [ 0xb8, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'UmsPerformingSyscall' : [ 0xb8, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'VdmSafe' : [ 0xb8, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'UmsDispatched' : [ 0xb8, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ReservedFlags' : [ 0xb8, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], 'ThreadFlags' : [ 0xb8, ['long']], 'ServiceTable' : [ 0xbc, ['pointer', ['void']]], 'WaitBlock' : [ 0xc0, ['array', 4, ['_KWAIT_BLOCK']]], @@ -2855,8 +2855,8 @@ nt_types = { 'ApcStateIndex' : [ 0x134, ['unsigned char']], 'BasePriority' : [ 0x135, ['unsigned char']], 'PriorityDecrement' : [ 0x136, ['unsigned char']], - 'ForegroundBoost' : [ 0x136, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'UnusualBoost' : [ 0x136, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'ForegroundBoost' : [ 0x136, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'UnusualBoost' : [ 0x136, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'Preempted' : [ 0x137, ['unsigned char']], 'AdjustReason' : [ 0x138, ['unsigned char']], 'AdjustIncrement' : [ 0x139, ['unsigned char']], @@ -2942,11 +2942,11 @@ nt_types = { 'Information' : [ 0x4, ['unsigned long']], } ], '_EX_PUSH_LOCK' : [ 0x4, { - 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'Locked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Waking' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'MultipleShared' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -2988,7 +2988,7 @@ nt_types = { } ], '_EX_FAST_REF' : [ 0x4, { 'Object' : [ 0x0, ['pointer', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], } ], '_EX_PUSH_LOCK_WAIT_BLOCK' : [ 0x30, { @@ -3029,51 +3029,51 @@ nt_types = { 'ReadClusterSize' : [ 0x278, ['unsigned long']], 'MmLockOrdering' : [ 0x27c, ['long']], 'CrossThreadFlags' : [ 0x280, ['unsigned long']], - 'Terminated' : [ 0x280, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ThreadInserted' : [ 0x280, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x280, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x280, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Reserved' : [ 0x280, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x280, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x280, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x280, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x280, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyTokenOnOpen' : [ 0x280, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ThreadIoPriority' : [ 0x280, ['BitField', dict(start_bit = 10, end_bit = 13)]], - 'ThreadPagePriority' : [ 0x280, ['BitField', dict(start_bit = 13, end_bit = 16)]], - 'RundownFail' : [ 0x280, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NeedsWorkingSetAging' : [ 0x280, ['BitField', dict(start_bit = 17, end_bit = 18)]], + 'Terminated' : [ 0x280, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ThreadInserted' : [ 0x280, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x280, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x280, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Reserved' : [ 0x280, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x280, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x280, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x280, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x280, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyTokenOnOpen' : [ 0x280, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ThreadIoPriority' : [ 0x280, ['BitField', dict(start_bit = 10, end_bit = 13, native_type='unsigned long')]], + 'ThreadPagePriority' : [ 0x280, ['BitField', dict(start_bit = 13, end_bit = 16, native_type='unsigned long')]], + 'RundownFail' : [ 0x280, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NeedsWorkingSetAging' : [ 0x280, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x284, ['unsigned long']], - 'ActiveExWorker' : [ 0x284, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x284, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x284, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ClonedThread' : [ 0x284, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'KeyedEventInUse' : [ 0x284, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RateApcState' : [ 0x284, ['BitField', dict(start_bit = 5, end_bit = 7)]], - 'SelfTerminate' : [ 0x284, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveExWorker' : [ 0x284, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x284, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x284, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ClonedThread' : [ 0x284, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'KeyedEventInUse' : [ 0x284, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RateApcState' : [ 0x284, ['BitField', dict(start_bit = 5, end_bit = 7, native_type='unsigned long')]], + 'SelfTerminate' : [ 0x284, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x288, ['unsigned long']], - 'Spare' : [ 0x288, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'StartAddressInvalid' : [ 0x288, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'EtwPageFaultCalloutActive' : [ 0x288, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsProcessWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'OwnsProcessWorkingSetShared' : [ 0x288, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsSystemCacheWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsSystemCacheWorkingSetShared' : [ 0x288, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsSessionWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsSessionWorkingSetShared' : [ 0x289, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsProcessAddressSpaceExclusive' : [ 0x289, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsProcessAddressSpaceShared' : [ 0x289, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SuppressSymbolLoad' : [ 0x289, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Prefetching' : [ 0x289, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'OwnsDynamicMemoryShared' : [ 0x289, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OwnsChangeControlAreaExclusive' : [ 0x289, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'OwnsChangeControlAreaShared' : [ 0x289, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'OwnsPagedPoolWorkingSetExclusive' : [ 0x28a, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnsPagedPoolWorkingSetShared' : [ 0x28a, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnsSystemPtesWorkingSetExclusive' : [ 0x28a, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'OwnsSystemPtesWorkingSetShared' : [ 0x28a, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'TrimTrigger' : [ 0x28a, ['BitField', dict(start_bit = 4, end_bit = 6)]], - 'Spare1' : [ 0x28a, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'Spare' : [ 0x288, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'StartAddressInvalid' : [ 0x288, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'EtwPageFaultCalloutActive' : [ 0x288, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsProcessWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'OwnsProcessWorkingSetShared' : [ 0x288, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsSystemCacheWorkingSetShared' : [ 0x288, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsSessionWorkingSetExclusive' : [ 0x288, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsSessionWorkingSetShared' : [ 0x289, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceExclusive' : [ 0x289, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsProcessAddressSpaceShared' : [ 0x289, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SuppressSymbolLoad' : [ 0x289, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Prefetching' : [ 0x289, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'OwnsDynamicMemoryShared' : [ 0x289, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'OwnsChangeControlAreaExclusive' : [ 0x289, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'OwnsChangeControlAreaShared' : [ 0x289, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetExclusive' : [ 0x28a, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'OwnsPagedPoolWorkingSetShared' : [ 0x28a, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetExclusive' : [ 0x28a, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'OwnsSystemPtesWorkingSetShared' : [ 0x28a, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'TrimTrigger' : [ 0x28a, ['BitField', dict(start_bit = 4, end_bit = 6, native_type='unsigned char')]], + 'Spare1' : [ 0x28a, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], 'PriorityRegionActive' : [ 0x28b, ['unsigned char']], 'CacheManagerActive' : [ 0x28c, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x28d, ['unsigned char']], @@ -3108,7 +3108,7 @@ nt_types = { 'DebugPort' : [ 0xec, ['pointer', ['void']]], 'ExceptionPortData' : [ 0xf0, ['pointer', ['void']]], 'ExceptionPortValue' : [ 0xf0, ['unsigned long']], - 'ExceptionPortState' : [ 0xf0, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'ExceptionPortState' : [ 0xf0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'ObjectTable' : [ 0xf4, ['pointer', ['_HANDLE_TABLE']]], 'Token' : [ 0xf8, ['_EX_FAST_REF']], 'WorkingSetPage' : [ 0xfc, ['unsigned long']], @@ -3166,56 +3166,56 @@ nt_types = { 'HighestUserAddress' : [ 0x264, ['pointer', ['void']]], 'ModifiedPageCount' : [ 0x268, ['unsigned long']], 'Flags2' : [ 0x26c, ['unsigned long']], - 'JobNotReallyActive' : [ 0x26c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AccountingFolded' : [ 0x26c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'NewProcessReported' : [ 0x26c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ExitProcessReported' : [ 0x26c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReportCommitChanges' : [ 0x26c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LastReportMemory' : [ 0x26c, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ReportPhysicalPageChanges' : [ 0x26c, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'HandleTableRundown' : [ 0x26c, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'NeedsHandleRundown' : [ 0x26c, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RefTraceEnabled' : [ 0x26c, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'NumaAware' : [ 0x26c, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtectedProcess' : [ 0x26c, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'DefaultPagePriority' : [ 0x26c, ['BitField', dict(start_bit = 12, end_bit = 15)]], - 'PrimaryTokenFrozen' : [ 0x26c, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessVerifierTarget' : [ 0x26c, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'StackRandomizationDisabled' : [ 0x26c, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'AffinityPermanent' : [ 0x26c, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'AffinityUpdateEnable' : [ 0x26c, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'PropagateNode' : [ 0x26c, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'ExplicitAffinity' : [ 0x26c, ['BitField', dict(start_bit = 21, end_bit = 22)]], + 'JobNotReallyActive' : [ 0x26c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AccountingFolded' : [ 0x26c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'NewProcessReported' : [ 0x26c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ExitProcessReported' : [ 0x26c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReportCommitChanges' : [ 0x26c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LastReportMemory' : [ 0x26c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'ReportPhysicalPageChanges' : [ 0x26c, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'HandleTableRundown' : [ 0x26c, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'NeedsHandleRundown' : [ 0x26c, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RefTraceEnabled' : [ 0x26c, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'NumaAware' : [ 0x26c, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtectedProcess' : [ 0x26c, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'DefaultPagePriority' : [ 0x26c, ['BitField', dict(start_bit = 12, end_bit = 15, native_type='unsigned long')]], + 'PrimaryTokenFrozen' : [ 0x26c, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessVerifierTarget' : [ 0x26c, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'StackRandomizationDisabled' : [ 0x26c, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'AffinityPermanent' : [ 0x26c, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'AffinityUpdateEnable' : [ 0x26c, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'PropagateNode' : [ 0x26c, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'ExplicitAffinity' : [ 0x26c, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], 'Flags' : [ 0x270, ['unsigned long']], - 'CreateReported' : [ 0x270, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x270, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x270, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x270, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x270, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x270, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x270, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x270, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x270, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Wow64VaSpace4Gb' : [ 0x270, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x270, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x270, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x270, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'DeprioritizeViews' : [ 0x270, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x270, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x270, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x270, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x270, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x270, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x270, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x270, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'ImageNotifyDone' : [ 0x270, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'PdeUpdateNeeded' : [ 0x270, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x270, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'CrossSessionCreate' : [ 0x270, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'ProcessInserted' : [ 0x270, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'DefaultIoPriority' : [ 0x270, ['BitField', dict(start_bit = 27, end_bit = 30)]], - 'ProcessSelfDelete' : [ 0x270, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'SetTimerResolutionLink' : [ 0x270, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x270, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x270, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x270, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x270, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x270, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x270, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x270, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x270, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x270, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Wow64VaSpace4Gb' : [ 0x270, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x270, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x270, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x270, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'DeprioritizeViews' : [ 0x270, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x270, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x270, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x270, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x270, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x270, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x270, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x270, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'ImageNotifyDone' : [ 0x270, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'PdeUpdateNeeded' : [ 0x270, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x270, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'CrossSessionCreate' : [ 0x270, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'ProcessInserted' : [ 0x270, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'DefaultIoPriority' : [ 0x270, ['BitField', dict(start_bit = 27, end_bit = 30, native_type='unsigned long')]], + 'ProcessSelfDelete' : [ 0x270, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'SetTimerResolutionLink' : [ 0x270, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x274, ['long']], 'VadRoot' : [ 0x278, ['_MM_AVL_TABLE']], 'AlpcContext' : [ 0x298, ['_ALPC_PROCESS_CONTEXT']], @@ -3237,11 +3237,11 @@ nt_types = { 'ReadyListHead' : [ 0x44, ['_LIST_ENTRY']], 'SwapListEntry' : [ 0x4c, ['_SINGLE_LIST_ENTRY']], 'ActiveProcessors' : [ 0x50, ['_KAFFINITY_EX']], - 'AutoAlignment' : [ 0x5c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DisableBoost' : [ 0x5c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableQuantum' : [ 0x5c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveGroupsMask' : [ 0x5c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ReservedFlags' : [ 0x5c, ['BitField', dict(start_bit = 4, end_bit = 32)]], + 'AutoAlignment' : [ 0x5c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='long')]], + 'DisableBoost' : [ 0x5c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='long')]], + 'DisableQuantum' : [ 0x5c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='long')]], + 'ActiveGroupsMask' : [ 0x5c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ReservedFlags' : [ 0x5c, ['BitField', dict(start_bit = 4, end_bit = 32, native_type='long')]], 'ProcessFlags' : [ 0x5c, ['long']], 'BasePriority' : [ 0x60, ['unsigned char']], 'QuantumReset' : [ 0x61, ['unsigned char']], @@ -3746,8 +3746,8 @@ nt_types = { 'Flags' : [ 0x4, ['unsigned char']], 'IsFastIoPossible' : [ 0x5, ['unsigned char']], 'Flags2' : [ 0x6, ['unsigned char']], - 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8)]], + 'Reserved' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned char')]], + 'Version' : [ 0x7, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], 'Resource' : [ 0x8, ['pointer', ['_ERESOURCE']]], 'PagingIoResource' : [ 0xc, ['pointer', ['_ERESOURCE']]], 'AllocationSize' : [ 0x10, ['_LARGE_INTEGER']], @@ -3850,11 +3850,11 @@ nt_types = { 'e2' : [ 0x0, ['__unnamed_14f6']], } ], '__unnamed_14fd' : [ 0x4, { - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25)]], - 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 25, native_type='unsigned long')]], + 'PfnImageVerified' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], } ], '_MMPFN' : [ 0x18, { 'u1' : [ 0x0, ['__unnamed_14f1']], @@ -3935,10 +3935,10 @@ nt_types = { 'NumberOfSystemCacheViews' : [ 0x0, ['unsigned long']], 'ImageRelocationStartBit' : [ 0x0, ['unsigned long']], 'WritableUserReferences' : [ 0x4, ['long']], - 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30)]], - 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'ImageRelocationSizeIn64k' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'Unused' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 30, native_type='unsigned long')]], + 'BitMap64' : [ 0x4, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'ImageActive' : [ 0x4, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubsectionRoot' : [ 0x8, ['pointer', ['_MM_SUBSECTION_AVL_TABLE']]], 'SeImageStub' : [ 0x8, ['pointer', ['_MI_IMAGE_SECURITY_REFERENCE']]], } ], @@ -3964,8 +3964,8 @@ nt_types = { 'ViewList' : [ 0x48, ['_LIST_ENTRY']], } ], '_MM_STORE_KEY' : [ 0x4, { - 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 28)]], - 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], + 'KeyLow' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 28, native_type='unsigned long')]], + 'KeyHigh' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], 'EntireKey' : [ 0x0, ['unsigned long']], } ], '_MMPAGING_FILE' : [ 0x50, { @@ -3983,11 +3983,11 @@ nt_types = { 'BitmapHint' : [ 0x34, ['unsigned long']], 'LastAllocationSize' : [ 0x38, ['unsigned long']], 'ToBeEvictedCount' : [ 0x3c, ['unsigned long']], - 'PageFileNumber' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'BootPartition' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Spare0' : [ 0x40, ['BitField', dict(start_bit = 5, end_bit = 16)]], - 'AdriftMdls' : [ 0x42, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare1' : [ 0x42, ['BitField', dict(start_bit = 1, end_bit = 16)]], + 'PageFileNumber' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned short')]], + 'BootPartition' : [ 0x40, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'Spare0' : [ 0x40, ['BitField', dict(start_bit = 5, end_bit = 16, native_type='unsigned short')]], + 'AdriftMdls' : [ 0x42, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Spare1' : [ 0x42, ['BitField', dict(start_bit = 1, end_bit = 16, native_type='unsigned short')]], 'FileHandle' : [ 0x44, ['pointer', ['void']]], 'Lock' : [ 0x48, ['unsigned long']], 'LockOwner' : [ 0x4c, ['pointer', ['_ETHREAD']]], @@ -3998,14 +3998,14 @@ nt_types = { } ], '_MM_AVL_TABLE' : [ 0x20, { 'BalancedRoot' : [ 0x0, ['_MMADDRESS_NODE']], - 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DepthOfTree' : [ 0x14, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x14, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x14, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'NodeHint' : [ 0x18, ['pointer', ['void']]], 'NodeFreeHint' : [ 0x1c, ['pointer', ['void']]], } ], '__unnamed_1581' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMVAD']]], } ], '__unnamed_1584' : [ 0x4, { @@ -4027,7 +4027,7 @@ nt_types = { 'u5' : [ 0x1c, ['__unnamed_1587']], } ], '__unnamed_158f' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMADDRESS_NODE']]], } ], '_MMADDRESS_NODE' : [ 0x14, { @@ -4212,16 +4212,16 @@ nt_types = { } ], '_CM_KEY_CONTROL_BLOCK' : [ 0xa0, { 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31)]], - 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HiveUnloaded' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Decommissioned' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'LockTablePresent' : [ 0x4, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 21, end_bit = 31, native_type='unsigned long')]], + 'DelayedDeref' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DelayedClose' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Parking' : [ 0x8, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'KeyHash' : [ 0xc, ['_CM_KEY_HASH']], 'ConvKey' : [ 0xc, ['unsigned long']], 'NextHash' : [ 0x10, ['pointer', ['_CM_KEY_HASH']]], @@ -4245,10 +4245,10 @@ nt_types = { 'KcbMaxNameLen' : [ 0x60, ['unsigned short']], 'KcbMaxValueNameLen' : [ 0x62, ['unsigned short']], 'KcbMaxValueDataLen' : [ 0x64, ['unsigned long']], - 'KcbUserFlags' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'KcbVirtControlFlags' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'KcbDebug' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Flags' : [ 0x68, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'KcbUserFlags' : [ 0x68, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0x68, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0x68, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0x68, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'KCBUoWListHead' : [ 0x6c, ['_LIST_ENTRY']], 'DelayQueueEntry' : [ 0x74, ['_LIST_ENTRY']], 'Stolen' : [ 0x74, ['pointer', ['unsigned char']]], @@ -4450,20 +4450,20 @@ nt_types = { 'MergedPrefLanguages' : [ 0xfc0, ['unsigned long']], 'MuiImpersonation' : [ 0xfc4, ['unsigned long']], 'CrossTebFlags' : [ 0xfc8, ['unsigned short']], - 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0xfc8, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0xfca, ['unsigned short']], - 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16)]], + 'SafeThunkCall' : [ 0xfca, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0xfca, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0xfca, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0xfca, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0xfca, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0xfca, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0xfca, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0xfca, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0xfca, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0xfca, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0xfca, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0xfca, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0xfcc, ['unsigned long']], 'TxnScopeExitCallback' : [ 0xfd0, ['unsigned long']], 'TxnScopeContext' : [ 0xfd4, ['unsigned long']], @@ -4553,20 +4553,20 @@ nt_types = { 'MergedPrefLanguages' : [ 0x17e0, ['unsigned long long']], 'MuiImpersonation' : [ 0x17e8, ['unsigned long']], 'CrossTebFlags' : [ 0x17ec, ['unsigned short']], - 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16)]], + 'SpareCrossTebBits' : [ 0x17ec, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned short')]], 'SameTebFlags' : [ 0x17ee, ['unsigned short']], - 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16)]], + 'SafeThunkCall' : [ 0x17ee, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'InDebugPrint' : [ 0x17ee, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'HasFiberData' : [ 0x17ee, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'SkipThreadAttach' : [ 0x17ee, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'WerInShipAssertCode' : [ 0x17ee, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned short')]], + 'RanProcessInit' : [ 0x17ee, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned short')]], + 'ClonedThread' : [ 0x17ee, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned short')]], + 'SuppressDebugMsg' : [ 0x17ee, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned short')]], + 'DisableUserStackWalk' : [ 0x17ee, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned short')]], + 'RtlExceptionAttached' : [ 0x17ee, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned short')]], + 'InitialThread' : [ 0x17ee, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned short')]], + 'SpareSameTebBits' : [ 0x17ee, ['BitField', dict(start_bit = 11, end_bit = 16, native_type='unsigned short')]], 'TxnScopeEnterCallback' : [ 0x17f0, ['unsigned long long']], 'TxnScopeExitCallback' : [ 0x17f8, ['unsigned long long']], 'TxnScopeContext' : [ 0x1800, ['unsigned long long']], @@ -4649,9 +4649,9 @@ nt_types = { 'PreviousTrapFrame' : [ 0x0, ['pointer', ['_KTRAP_FRAME']]], 'PreviousExceptionList' : [ 0x0, ['pointer', ['void']]], 'StackControlFlags' : [ 0x4, ['unsigned long']], - 'PreviousLargeStack' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousSegmentsPresent' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ExpandCalloutStack' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'PreviousLargeStack' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousSegmentsPresent' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ExpandCalloutStack' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'Previous' : [ 0x8, ['_KERNEL_STACK_SEGMENT']], } ], '_KTRAP_FRAME' : [ 0x8c, { @@ -5305,12 +5305,12 @@ nt_types = { 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], 'BeingDebugged' : [ 0x2, ['unsigned char']], 'BitField' : [ 0x3, ['unsigned char']], - 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'ImageUsesLargePages' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsProtectedProcess' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'IsLegacyProcess' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'IsImageDynamicallyRelocated' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'SkipPatchingUser32Forwarders' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'SpareBits' : [ 0x3, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], 'Mutant' : [ 0x4, ['pointer', ['void']]], 'ImageBaseAddress' : [ 0x8, ['pointer', ['void']]], 'Ldr' : [ 0xc, ['pointer', ['_PEB_LDR_DATA']]], @@ -5321,12 +5321,12 @@ nt_types = { 'AtlThunkSListPtr' : [ 0x20, ['pointer', ['void']]], 'IFEOKey' : [ 0x24, ['pointer', ['void']]], 'CrossProcessFlags' : [ 0x28, ['unsigned long']], - 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32)]], + 'ProcessInJob' : [ 0x28, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProcessInitializing' : [ 0x28, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessUsingVEH' : [ 0x28, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessUsingVCH' : [ 0x28, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ProcessUsingFTH' : [ 0x28, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'ReservedBits0' : [ 0x28, ['BitField', dict(start_bit = 5, end_bit = 32, native_type='unsigned long')]], 'KernelCallbackTable' : [ 0x2c, ['pointer', ['void']]], 'UserSharedInfoPtr' : [ 0x2c, ['pointer', ['void']]], 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], @@ -5389,9 +5389,9 @@ nt_types = { 'pContextData' : [ 0x238, ['pointer', ['void']]], 'pImageHeaderHash' : [ 0x23c, ['pointer', ['void']]], 'TracingFlags' : [ 0x240, ['unsigned long']], - 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'HeapTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CritSecTracingEnabled' : [ 0x240, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SpareTracingBits' : [ 0x240, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_PEB_LDR_DATA' : [ 0x30, { 'Length' : [ 0x0, ['unsigned long']], @@ -5487,10 +5487,10 @@ nt_types = { 'LookasideIndex' : [ 0x20, ['unsigned long']], } ], '__unnamed_1980' : [ 0x1, { - 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], + 'ReferenceCache' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Lookaside' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Initializing' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Deleted' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], } ], '__unnamed_1982' : [ 0x1, { 's1' : [ 0x0, ['__unnamed_1980']], @@ -5507,8 +5507,8 @@ nt_types = { 'Pad' : [ 0x14, ['unsigned long']], } ], '__unnamed_1994' : [ 0x4, { - 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Internal' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_1996' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1994']], @@ -5525,7 +5525,7 @@ nt_types = { 'RegionListHead' : [ 0x20, ['_LIST_ENTRY']], } ], '__unnamed_199c' : [ 0x4, { - 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'Secure' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], } ], '__unnamed_199e' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_199c']], @@ -5543,9 +5543,9 @@ nt_types = { 'ReadWriteView' : [ 0x2c, ['pointer', ['_KALPC_VIEW']]], } ], '__unnamed_19a4' : [ 0x4, { - 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'WriteAccess' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoRelease' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ForceUnlink' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], } ], '__unnamed_19a6' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19a4']], @@ -5571,22 +5571,22 @@ nt_types = { 'HandleTable' : [ 0x14, ['_ALPC_HANDLE_TABLE']], } ], '__unnamed_19c2' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned long')]], + 'ConnectionPending' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ConnectionRefused' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Disconnected' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Closed' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'NoFlushOnClose' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReturnExtendedInfo' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Waitable' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DynamicSecurity' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Wow64CompletionList' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Lpc' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'LpcToLpc' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HasCompletionList' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'HadCompletionList' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'EnableCompletionList' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], } ], '__unnamed_19c4' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19c2']], @@ -5642,18 +5642,18 @@ nt_types = { 'CallbackList' : [ 0x80, ['_LIST_ENTRY']], } ], '__unnamed_19dc' : [ 0x4, { - 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], + 'QueueType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'QueuePortType' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Canceled' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Ready' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ReleaseMessage' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SharedQuota' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'ReplyWaitReply' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'OwnerPortReference' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'ReserveReference' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'ReceiverReference' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'ViewAttributeRetrieved' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'InDispatch' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], } ], '__unnamed_19de' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_19dc']], @@ -5710,8 +5710,8 @@ nt_types = { 'HandleData' : [ 0x18, ['pointer', ['_KALPC_HANDLE_DATA']]], } ], '__unnamed_1a1b' : [ 0x4, { - 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], + 'Revoked' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Impersonated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], } ], '__unnamed_1a1d' : [ 0x4, { 's1' : [ 0x0, ['__unnamed_1a1b']], @@ -5903,23 +5903,23 @@ nt_types = { 'SecurityDescriptor' : [ 0x21c, ['_EX_FAST_REF']], 'BufferSequenceNumber' : [ 0x220, ['long long']], 'Flags' : [ 0x228, ['unsigned long']], - 'Persistent' : [ 0x228, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AutoLogger' : [ 0x228, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'FsReady' : [ 0x228, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RealTime' : [ 0x228, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow' : [ 0x228, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelTrace' : [ 0x228, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'NoMoreEnable' : [ 0x228, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'StackTracing' : [ 0x228, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ErrorLogged' : [ 0x228, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'RealtimeLoggerContextFreed' : [ 0x228, ['BitField', dict(start_bit = 9, end_bit = 10)]], + 'Persistent' : [ 0x228, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AutoLogger' : [ 0x228, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'FsReady' : [ 0x228, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RealTime' : [ 0x228, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow' : [ 0x228, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'KernelTrace' : [ 0x228, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'NoMoreEnable' : [ 0x228, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'StackTracing' : [ 0x228, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ErrorLogged' : [ 0x228, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'RealtimeLoggerContextFreed' : [ 0x228, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], 'RequestFlag' : [ 0x22c, ['unsigned long']], - 'RequestNewFie' : [ 0x22c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'RequestUpdateFile' : [ 0x22c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'RequestFlush' : [ 0x22c, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'RequestDisableRealtime' : [ 0x22c, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'RequestDisconnectConsumer' : [ 0x22c, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'RequestConnectConsumer' : [ 0x22c, ['BitField', dict(start_bit = 5, end_bit = 6)]], + 'RequestNewFie' : [ 0x22c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'RequestUpdateFile' : [ 0x22c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'RequestFlush' : [ 0x22c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'RequestDisableRealtime' : [ 0x22c, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'RequestDisconnectConsumer' : [ 0x22c, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'RequestConnectConsumer' : [ 0x22c, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], 'HookIdMap' : [ 0x230, ['_RTL_BITMAP']], } ], '_ETW_LOGGER_HANDLE' : [ 0x1, { @@ -5969,8 +5969,8 @@ nt_types = { 'EnableFlags' : [ 0x0, ['_LARGE_INTEGER']], 'LoggerId' : [ 0x8, ['unsigned short']], 'Level' : [ 0xa, ['unsigned char']], - 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8)]], + 'Enabled' : [ 0xb, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'InternalFlag' : [ 0xb, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned char')]], } ], '_TRACE_ENABLE_CONTEXT' : [ 0x8, { 'LoggerId' : [ 0x0, ['unsigned short']], @@ -6117,8 +6117,8 @@ nt_types = { '_PS_CLIENT_SECURITY_CONTEXT' : [ 0x4, { 'ImpersonationData' : [ 0x0, ['unsigned long']], 'ImpersonationToken' : [ 0x0, ['pointer', ['void']]], - 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ImpersonationLevel' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'EffectiveOnly' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], } ], '_DBGKD_ANY_CONTROL_SET' : [ 0x1c, { 'X86ControlSet' : [ 0x0, ['_X86_DBGKD_CONTROL_SET']], @@ -6129,12 +6129,12 @@ nt_types = { 'PpcControlSet' : [ 0x0, ['_PPC_DBGKD_CONTROL_SET']], } ], '_MMVAD_FLAGS3' : [ 0x4, { - 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6)]], - 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24)]], - 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'PreferredNode' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 6, native_type='unsigned long')]], + 'Teb' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SequentialAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'LastSequentialTrim' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 24, native_type='unsigned long')]], + 'Spare2' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_MI_VERIFIER_POOL_HEADER' : [ 0x4, { 'VerifierPoolEntry' : [ 0x0, ['pointer', ['_VI_POOL_ENTRY']]], @@ -6197,19 +6197,19 @@ nt_types = { 'Request' : [ 0x18, ['_PORT_MESSAGE']], } ], '_HARDWARE_PTE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_DUAL' : [ 0x13c, { 'Length' : [ 0x0, ['unsigned long']], @@ -6244,36 +6244,36 @@ nt_types = { } ], '_KSTACK_COUNT' : [ 0x4, { 'Value' : [ 0x0, ['long']], - 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'State' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'StackCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], } ], '_DISPATCHER_HEADER' : [ 0x10, { 'Type' : [ 0x0, ['unsigned char']], 'TimerControlFlags' : [ 0x1, ['unsigned char']], - 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Coalescable' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'KeepShifting' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'Absolute' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Coalescable' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'KeepShifting' : [ 0x1, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'EncodedTolerableDelay' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], 'Abandoned' : [ 0x1, ['unsigned char']], 'Signalling' : [ 0x1, ['unsigned char']], 'ThreadControlFlags' : [ 0x2, ['unsigned char']], - 'CpuThrottled' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'CpuThrottled' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'CycleProfiling' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'CounterProfiling' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], 'Hand' : [ 0x2, ['unsigned char']], 'Size' : [ 0x2, ['unsigned char']], 'TimerMiscFlags' : [ 0x3, ['unsigned char']], - 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Processor' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 6)]], - 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'Index' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Processor' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned char')]], + 'Inserted' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Expired' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], 'DebugActive' : [ 0x3, ['unsigned char']], - 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved2' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ActiveDR7' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'Instrumented' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved2' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned char')]], + 'UmsScheduled' : [ 0x3, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'UmsPrimary' : [ 0x3, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], 'DpcActive' : [ 0x3, ['unsigned char']], 'Lock' : [ 0x0, ['long']], 'SignalState' : [ 0x4, ['long']], @@ -6288,8 +6288,8 @@ nt_types = { 'Flags' : [ 0x0, ['_MM_PAGE_ACCESS_INFO_FLAGS']], 'FileOffset' : [ 0x0, ['unsigned long long']], 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], - 'DontUse0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'DontUse0' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'PointerProtoPte' : [ 0x4, ['pointer', ['void']]], } ], '_HEAP_COUNTERS' : [ 0x54, { @@ -6386,7 +6386,7 @@ nt_types = { 'DebugInfo' : [ 0x1c, ['pointer', ['_HANDLE_TRACE_DEBUG_INFO']]], 'ExtraInfoPages' : [ 0x20, ['long']], 'Flags' : [ 0x24, ['unsigned long']], - 'StrictFIFO' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], 'FirstFreeHandle' : [ 0x28, ['unsigned long']], 'LastFreeHandleEntry' : [ 0x2c, ['pointer', ['_HANDLE_TABLE_ENTRY']]], 'HandleCount' : [ 0x30, ['unsigned long']], @@ -6400,15 +6400,15 @@ nt_types = { 'NumberOfBytes' : [ 0xc, ['unsigned long']], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_TEB_ACTIVE_FRAME' : [ 0xc, { 'Flags' : [ 0x0, ['unsigned long']], @@ -6429,8 +6429,8 @@ nt_types = { 'NotifyBlock' : [ 0x8, ['pointer', ['_CM_NOTIFY_BLOCK']]], 'ProcessID' : [ 0xc, ['pointer', ['void']]], 'KeyBodyList' : [ 0x10, ['_LIST_ENTRY']], - 'Flags' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'HandleTags' : [ 0x18, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'Flags' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'HandleTags' : [ 0x18, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'KtmTrans' : [ 0x1c, ['pointer', ['void']]], 'KtmUow' : [ 0x20, ['pointer', ['_GUID']]], 'ContextListHead' : [ 0x24, ['_LIST_ENTRY']], @@ -6445,20 +6445,20 @@ nt_types = { 'BlockState' : [ 0x17, ['unsigned char']], } ], '_MMPTE_PROTOTYPE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 9)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 9, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_WHEA_ERROR_PACKET_FLAGS' : [ 0x4, { - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HypervisorError' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PlatformPfaControl' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'PlatformDirectedOffline' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_THERMAL_INFORMATION_EX' : [ 0x58, { @@ -6475,15 +6475,15 @@ nt_types = { 'S4TransitionTripPoint' : [ 0x54, ['unsigned long']], } ], '__unnamed_1c1d' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Spare0' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], } ], '__unnamed_1c1f' : [ 0x4, { - 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], + 'FilePointerIndex' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned long')]], + 'HardFault' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Spare1' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], } ], '_MM_PAGE_ACCESS_INFO_FLAGS' : [ 0x4, { 'File' : [ 0x0, ['__unnamed_1c1d']], @@ -6495,14 +6495,14 @@ nt_types = { 'Parameters' : [ 0x8, ['array', 2, ['unsigned long']]], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16)]], - 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16)]], + 'SubsectionAccessed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 6, native_type='unsigned short')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned short')]], + 'SubsectionStatic' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned short')]], + 'GlobalMemory' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned short')]], + 'DirtyPages' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned short')]], + 'Spare' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned short')]], + 'SectorEndOffset' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 16, native_type='unsigned short')]], } ], '_EXCEPTION_POINTERS' : [ 0x8, { 'ExceptionRecord' : [ 0x0, ['pointer', ['_EXCEPTION_RECORD']]], @@ -6570,9 +6570,9 @@ nt_types = { 'u4' : [ 0x44, ['__unnamed_1c47']], } ], '_MMWSLE_FREE_ENTRY' : [ 0x4, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 12)]], - 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousFree' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 12, native_type='unsigned long')]], + 'NextFree' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_NT_TIB' : [ 0x1c, { 'ExceptionList' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], @@ -6635,10 +6635,10 @@ nt_types = { } ], '__unnamed_1c58' : [ 0x4, { 'AsULONG' : [ 0x0, ['unsigned long']], - 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'AllowScaling' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Disabled' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HvMaxCState' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], } ], '_PPM_IDLE_STATES' : [ 0x60, { 'Count' : [ 0x0, ['unsigned long']], @@ -6654,8 +6654,8 @@ nt_types = { 'PcatInformation' : [ 0x0, ['_PCAT_FIRMWARE_INFORMATION']], } ], '_FIRMWARE_INFORMATION_LOADER_BLOCK' : [ 0x14, { - 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'FirmwareTypeEfi' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'u' : [ 0x4, ['__unnamed_1c61']], } ], '_HEAP_UCR_DESCRIPTOR' : [ 0x18, { @@ -6693,16 +6693,16 @@ nt_types = { 'BaseHi' : [ 0x3, ['unsigned char']], } ], '__unnamed_1c70' : [ 0x4, { - 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1c72' : [ 0x4, { 'Bytes' : [ 0x0, ['__unnamed_1c6a']], @@ -6772,9 +6772,9 @@ nt_types = { 'PostList' : [ 0x8, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x10, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x14, ['pointer', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_KINTERRUPT' : [ 0x278, { @@ -6896,19 +6896,19 @@ nt_types = { 'Lock' : [ 0xc, ['_EX_PUSH_LOCK']], } ], '_MMPTE_HARDWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Dirty1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x8, { 'Port' : [ 0x0, ['pointer', ['void']]], @@ -7035,13 +7035,13 @@ nt_types = { 'List' : [ 0x4, ['unsigned long']], } ], '_MMVAD_FLAGS' : [ 0x4, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'VadType' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 23, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 31, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_MMWSLE_HASH' : [ 0x4, { 'Index' : [ 0x0, ['unsigned long']], @@ -7078,10 +7078,10 @@ nt_types = { } ], '_VF_TRACKER_STAMP' : [ 0x8, { 'Thread' : [ 0x0, ['pointer', ['void']]], - 'Flags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'OldIrql' : [ 0x5, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'NewIrql' : [ 0x6, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Processor' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 8)]], + 'Flags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'OldIrql' : [ 0x5, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'NewIrql' : [ 0x6, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'Processor' : [ 0x7, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], } ], '_VI_TRACK_IRQL' : [ 0x20, { 'Thread' : [ 0x0, ['pointer', ['void']]], @@ -7125,7 +7125,7 @@ nt_types = { '_XSTATE_CONFIGURATION' : [ 0x210, { 'EnabledFeatures' : [ 0x0, ['unsigned long long']], 'Size' : [ 0x8, ['unsigned long']], - 'OptimizedSave' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'OptimizedSave' : [ 0xc, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], 'Features' : [ 0x10, ['array', 64, ['_XSTATE_FEATURE']]], } ], '_CM_KEY_SECURITY_CACHE' : [ 0x2c, { @@ -7137,12 +7137,12 @@ nt_types = { 'Descriptor' : [ 0x18, ['_SECURITY_DESCRIPTOR_RELATIVE']], } ], '_MMPTE_SOFTWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_NT_TIB32' : [ 0x1c, { 'ExceptionList' : [ 0x0, ['unsigned long']], @@ -7169,9 +7169,9 @@ nt_types = { } ], '_MM_SUBSECTION_AVL_TABLE' : [ 0x20, { 'BalancedRoot' : [ 0x0, ['_MMSUBSECTION_NODE']], - 'DepthOfTree' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'Unused' : [ 0x18, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'NumberGenericTableElements' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32)]], + 'DepthOfTree' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'Unused' : [ 0x18, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'NumberGenericTableElements' : [ 0x18, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], 'NodeHint' : [ 0x1c, ['pointer', ['void']]], } ], '_HANDLE_TABLE_ENTRY_INFO' : [ 0x4, { @@ -7183,13 +7183,13 @@ nt_types = { 'PartialResourceList' : [ 0x8, ['_CM_PARTIAL_RESOURCE_LIST']], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_FLAGS' : [ 0x4, { - 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'Primary' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ContainmentWarning' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reset' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ThresholdExceeded' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'ResourceNotAvailable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'LatentError' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_WMI_BUFFER_HEADER' : [ 0x48, { @@ -7269,17 +7269,17 @@ nt_types = { 'CurrentSymbolEnd' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x2, { - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], - 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], + 'Priority' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'Rom' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'InPageError' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'KernelStack' : [ 0x1, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'RemovalRequested' : [ 0x1, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'ParityError' : [ 0x1, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], '_SEGMENT_OBJECT' : [ 0x28, { 'BaseAddress' : [ 0x0, ['pointer', ['void']]], @@ -7366,21 +7366,21 @@ nt_types = { 'DataLength' : [ 0x8, ['unsigned long']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8)]], + 'WorkingSetType' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'ModwriterAttached' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaximumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'ForceTrim' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'MinimumWorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], + 'SessionMaster' : [ 0x1, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'TrimmerState' : [ 0x1, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'Reserved' : [ 0x1, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PageStealers' : [ 0x1, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned char')]], + 'MemoryPriority' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned char')]], + 'WsleDeleted' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'VmExiting' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'ExpansionFailed' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Available' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned char')]], } ], '_IMAGE_OPTIONAL_HEADER' : [ 0xe0, { 'Magic' : [ 0x0, ['unsigned short']], @@ -7526,9 +7526,9 @@ nt_types = { } ], '_OWNER_ENTRY' : [ 0x8, { 'OwnerThread' : [ 0x0, ['unsigned long']], - 'IoPriorityBoosted' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OwnerReferenced' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'OwnerCount' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'IoPriorityBoosted' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OwnerReferenced' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'OwnerCount' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'TableSize' : [ 0x4, ['unsigned long']], } ], '_MI_SECTION_CREATION_GATE' : [ 0x14, { @@ -7656,26 +7656,26 @@ nt_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved1' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 19, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -7785,12 +7785,12 @@ nt_types = { 'Metrics' : [ 0xe8, ['_POP_THERMAL_ZONE_METRICS']], } ], '_MMPTE_LIST' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_VI_POOL_PAGE_HEADER' : [ 0xc, { 'NextPage' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], @@ -7836,10 +7836,10 @@ nt_types = { 'HiveArray' : [ 0x48, ['array', 7, ['pointer', ['_CMHIVE']]]], } ], '_WHEA_ERROR_RECORD_HEADER_VALIDBITS' : [ 0x4, { - 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'PlatformId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Timestamp' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'PartitionId' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x18, { @@ -7917,8 +7917,8 @@ nt_types = { 'PolicySetStatus' : [ 0x1b, ['unsigned char']], } ], '__unnamed_1e8a' : [ 0x4, { - 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'SnapSharedExportsFailed' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], } ], '__unnamed_1e8c' : [ 0xc, { 'AllSharedExportThunks' : [ 0x0, ['_VF_TARGET_ALL_SHARED_EXPORT_THUNKS']], @@ -7996,12 +7996,12 @@ nt_types = { 'BaseName' : [ 0x10, ['_UNICODE_STRING']], } ], '_MMPTE_TIMESTAMP' : [ 0x4, { - 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'MustBeZero' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'GlobalTimeStamp' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_SID_AND_ATTRIBUTES_HASH' : [ 0x88, { 'SidCount' : [ 0x0, ['unsigned long']], @@ -8055,8 +8055,8 @@ nt_types = { 'SessionId' : [ 0x8, ['unsigned long']], 'CpuShareWeight' : [ 0xc, ['unsigned long']], 'CapturedWeightData' : [ 0x10, ['_PSP_CPU_SHARE_CAPTURED_WEIGHT_DATA']], - 'DuplicateInputMarker' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x18, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'DuplicateInputMarker' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x18, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'MiscFlags' : [ 0x18, ['long']], 'BlockCurrentGenerationLock' : [ 0x0, ['unsigned long']], 'CyclesAccumulated' : [ 0x8, ['unsigned long long']], @@ -8068,10 +8068,10 @@ nt_types = { } ], '__unnamed_1ec3' : [ 0x1, { 'AsUCHAR' : [ 0x0, ['unsigned char']], - 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3)]], - 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], + 'NoDomainAccounting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IncreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 3, native_type='unsigned char')]], + 'DecreasePolicy' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 5, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned char')]], } ], 'PROCESSOR_PERFSTATE_POLICY' : [ 0x1c, { 'Revision' : [ 0x0, ['unsigned long']], @@ -8103,25 +8103,25 @@ nt_types = { 'Busy' : [ 0x10, ['unsigned char']], } ], '_SYSTEM_POWER_STATE_CONTEXT' : [ 0x4, { - 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'Reserved1' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'TargetSystemState' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'EffectiveSystemState' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'CurrentSystemState' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'IgnoreHibernationPath' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'PseudoTransition' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Reserved2' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'ContextAsUlong' : [ 0x0, ['unsigned long']], } ], '_OBJECT_TYPE_INITIALIZER' : [ 0x50, { 'Length' : [ 0x0, ['unsigned short']], 'ObjectTypeFlags' : [ 0x2, ['unsigned char']], - 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7)]], + 'CaseInsensitive' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'UnnamedObjectsOnly' : [ 0x2, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'UseDefaultObject' : [ 0x2, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'SecurityRequired' : [ 0x2, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'MaintainHandleCount' : [ 0x2, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'MaintainTypeList' : [ 0x2, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'SupportsObjectCallbacks' : [ 0x2, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], 'ObjectTypeCode' : [ 0x4, ['unsigned long']], 'InvalidAttributes' : [ 0x8, ['unsigned long']], 'GenericMapping' : [ 0xc, ['_GENERIC_MAPPING']], @@ -8182,14 +8182,14 @@ nt_types = { 'ActualLimit' : [ 0x10, ['unsigned long']], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'DisableExceptionChainValidation' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], 'ExecuteOptions' : [ 0x0, ['unsigned char']], } ], '_SEP_TOKEN_PRIVILEGES' : [ 0x18, { @@ -8223,13 +8223,13 @@ nt_types = { 'Reserved' : [ 0xc, ['unsigned long']], } ], '_MMWSLENTRY' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 12, native_type='unsigned long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_DBGKD_SWITCH_PARTITION' : [ 0x4, { 'Partition' : [ 0x0, ['unsigned long']], @@ -8258,15 +8258,15 @@ nt_types = { 'Exchg' : [ 0x0, ['long long']], } ], '_WHEA_TIMESTAMP' : [ 0x8, { - 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32)]], - 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40)]], - 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48)]], - 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56)]], - 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64)]], + 'Seconds' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long long')]], + 'Minutes' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long long')]], + 'Hours' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long long')]], + 'Precise' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 32, native_type='unsigned long long')]], + 'Day' : [ 0x0, ['BitField', dict(start_bit = 32, end_bit = 40, native_type='unsigned long long')]], + 'Month' : [ 0x0, ['BitField', dict(start_bit = 40, end_bit = 48, native_type='unsigned long long')]], + 'Year' : [ 0x0, ['BitField', dict(start_bit = 48, end_bit = 56, native_type='unsigned long long')]], + 'Century' : [ 0x0, ['BitField', dict(start_bit = 56, end_bit = 64, native_type='unsigned long long')]], 'AsLARGE_INTEGER' : [ 0x0, ['_LARGE_INTEGER']], } ], '_VPB' : [ 0x58, { @@ -8352,10 +8352,10 @@ nt_types = { 'HandleAttributes' : [ 0x14, ['unsigned long']], } ], '_MMPTE_SUBSECTION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_POWER_STATE' : [ 0x4, { 'SystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], @@ -8472,7 +8472,7 @@ nt_types = { 'NumberOfSpecialCalls' : [ 0x0, ['unsigned long']], } ], '__unnamed_1f82' : [ 0x4, { - 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2)]], + 'Balance' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='long')]], 'Parent' : [ 0x0, ['pointer', ['_MMSUBSECTION_NODE']]], } ], '_MMSUBSECTION_NODE' : [ 0x18, { @@ -8515,9 +8515,9 @@ nt_types = { 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], } ], '_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR_VALIDBITS' : [ 0x1, { - 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8)]], + 'FRUId' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'FRUText' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 8, native_type='unsigned char')]], 'AsUCHAR' : [ 0x0, ['unsigned char']], } ], '_FS_FILTER_CALLBACKS' : [ 0x38, { @@ -8688,10 +8688,10 @@ nt_types = { 'BankTemplate' : [ 0x1c, ['array', 1, ['_MMPTE']]], } ], '_WHEA_ERROR_RECORD_HEADER_FLAGS' : [ 0x4, { - 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Recovered' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PreviousError' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Simulated' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_XSAVE_AREA_HEADER' : [ 0x40, { diff --git a/volatility/plugins/overlays/windows/xp_sp2_x86_vtypes.py b/volatility/plugins/overlays/windows/xp_sp2_x86_vtypes.py index 5d4770b5..d5a4cb0a 100644 --- a/volatility/plugins/overlays/windows/xp_sp2_x86_vtypes.py +++ b/volatility/plugins/overlays/windows/xp_sp2_x86_vtypes.py @@ -1,4 +1,4 @@ -nt_types = { +ntkrnlmp_types = { 'LIST_ENTRY64' : [ 0x10, { 'Flink' : [ 0x0, ['unsigned long long']], 'Blink' : [ 0x8, ['unsigned long long']], @@ -58,56 +58,6 @@ nt_types = { } ], '_SINGLE_LIST_ENTRY' : [ 0x4, { 'Next' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], -} ], - '_HARDWARE_PTE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], -} ], - '_SLIST_HEADER' : [ 0x8, { - 'Alignment' : [ 0x0, ['unsigned long long']], - 'Next' : [ 0x0, ['_SINGLE_LIST_ENTRY']], - 'Depth' : [ 0x4, ['unsigned short']], - 'Sequence' : [ 0x6, ['unsigned short']], -} ], - '_NPAGED_LOOKASIDE_LIST' : [ 0x100, { - 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], - 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['unsigned long']], -} ], - '_PAGED_LOOKASIDE_LIST' : [ 0x100, { - 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], - 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['_FAST_MUTEX']], -} ], - '_GENERAL_LOOKASIDE' : [ 0x80, { - 'ListHead' : [ 0x0, ['_SLIST_HEADER']], - 'Depth' : [ 0x8, ['unsigned short']], - 'MaximumDepth' : [ 0xa, ['unsigned short']], - 'TotalAllocates' : [ 0xc, ['unsigned long']], - 'AllocateMisses' : [ 0x10, ['unsigned long']], - 'AllocateHits' : [ 0x10, ['unsigned long']], - 'TotalFrees' : [ 0x14, ['unsigned long']], - 'FreeMisses' : [ 0x18, ['unsigned long']], - 'FreeHits' : [ 0x18, ['unsigned long']], - 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], - 'Tag' : [ 0x20, ['unsigned long']], - 'Size' : [ 0x24, ['unsigned long']], - 'Allocate' : [ 0x28, ['pointer', ['void']]], - 'Free' : [ 0x2c, ['pointer', ['void']]], - 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], - 'LastTotalAllocates' : [ 0x38, ['unsigned long']], - 'LastAllocateMisses' : [ 0x3c, ['unsigned long']], - 'LastAllocateHits' : [ 0x3c, ['unsigned long']], - 'Future' : [ 0x40, ['array', 2, ['unsigned long']]], } ], '_KPRCB' : [ 0xc50, { 'MinorVersion' : [ 0x0, ['unsigned short']], @@ -201,6 +151,41 @@ nt_types = { 'UpdateSignature' : [ 0x918, ['_LARGE_INTEGER']], 'NpxSaveArea' : [ 0x920, ['_FX_SAVE_AREA']], 'PowerState' : [ 0xb30, ['_PROCESSOR_POWER_STATE']], +} ], + '_SLIST_HEADER' : [ 0x8, { + 'Alignment' : [ 0x0, ['unsigned long long']], + 'Next' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x4, ['unsigned short']], + 'Sequence' : [ 0x6, ['unsigned short']], +} ], + '_NPAGED_LOOKASIDE_LIST' : [ 0x100, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], + 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['unsigned long']], +} ], + '_PAGED_LOOKASIDE_LIST' : [ 0x100, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], + 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['_FAST_MUTEX']], +} ], + '_GENERAL_LOOKASIDE' : [ 0x80, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'Depth' : [ 0x8, ['unsigned short']], + 'MaximumDepth' : [ 0xa, ['unsigned short']], + 'TotalAllocates' : [ 0xc, ['unsigned long']], + 'AllocateMisses' : [ 0x10, ['unsigned long']], + 'AllocateHits' : [ 0x10, ['unsigned long']], + 'TotalFrees' : [ 0x14, ['unsigned long']], + 'FreeMisses' : [ 0x18, ['unsigned long']], + 'FreeHits' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x20, ['unsigned long']], + 'Size' : [ 0x24, ['unsigned long']], + 'Allocate' : [ 0x28, ['pointer', ['void']]], + 'Free' : [ 0x2c, ['pointer', ['void']]], + 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x38, ['unsigned long']], + 'LastAllocateMisses' : [ 0x3c, ['unsigned long']], + 'LastAllocateHits' : [ 0x3c, ['unsigned long']], + 'Future' : [ 0x40, ['array', 2, ['unsigned long']]], } ], '_EX_RUNDOWN_REF' : [ 0x4, { 'Count' : [ 0x0, ['unsigned long']], @@ -208,13 +193,13 @@ nt_types = { } ], '_EX_FAST_REF' : [ 0x4, { 'Object' : [ 0x0, ['pointer', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], } ], '_EX_PUSH_LOCK' : [ 0x4, { - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Exclusive' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Exclusive' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -224,14 +209,14 @@ nt_types = { 'ShareCount' : [ 0x14, ['unsigned long']], 'Exclusive' : [ 0x18, ['unsigned char']], } ], - '_EX_PUSH_LOCK_CACHE_AWARE' : [ 0x4, { - 'Locks' : [ 0x0, ['array', 1, ['pointer', ['_EX_PUSH_LOCK']]]], + '_EX_PUSH_LOCK_CACHE_AWARE' : [ 0x80, { + 'Locks' : [ 0x0, ['array', 32, ['pointer', ['_EX_PUSH_LOCK']]]], } ], '_ETHREAD' : [ 0x258, { 'Tcb' : [ 0x0, ['_KTHREAD']], 'CreateTime' : [ 0x1c0, ['_LARGE_INTEGER']], - 'NestedFaultCount' : [ 0x1c0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'ApcNeeded' : [ 0x1c0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'NestedFaultCount' : [ 0x1c0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'ApcNeeded' : [ 0x1c0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'ExitTime' : [ 0x1c8, ['_LARGE_INTEGER']], 'LpcReplyChain' : [ 0x1c8, ['_LIST_ENTRY']], 'KeyedWaitChain' : [ 0x1c8, ['_LIST_ENTRY']], @@ -263,23 +248,23 @@ nt_types = { 'ReadClusterSize' : [ 0x240, ['unsigned long']], 'GrantedAccess' : [ 0x244, ['unsigned long']], 'CrossThreadFlags' : [ 0x248, ['unsigned long']], - 'Terminated' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeadThread' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x248, ['BitField', dict(start_bit = 8, end_bit = 9)]], + 'Terminated' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeadThread' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x248, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x24c, ['unsigned long']], - 'ActiveExWorker' : [ 0x24c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x24c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x24c, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ActiveExWorker' : [ 0x24c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x24c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x24c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x250, ['unsigned long']], - 'LpcReceivedMsgIdValid' : [ 0x250, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LpcExitThreadCalled' : [ 0x250, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'AddressSpaceOwner' : [ 0x250, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'LpcReceivedMsgIdValid' : [ 0x250, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'LpcExitThreadCalled' : [ 0x250, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'AddressSpaceOwner' : [ 0x250, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], 'ForwardClusterOnly' : [ 0x254, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x255, ['unsigned char']], } ], @@ -356,33 +341,33 @@ nt_types = { 'NumberOfVads' : [ 0x240, ['unsigned long']], 'JobStatus' : [ 0x244, ['unsigned long']], 'Flags' : [ 0x248, ['unsigned long']], - 'CreateReported' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x248, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'HasPhysicalVad' : [ 0x248, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x248, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x248, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x248, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'SessionCreationUnderway' : [ 0x248, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x248, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x248, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x248, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x248, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x248, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x248, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x248, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Unused3' : [ 0x248, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Unused4' : [ 0x248, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x248, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'Unused' : [ 0x248, ['BitField', dict(start_bit = 25, end_bit = 30)]], - 'Unused1' : [ 0x248, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'Unused2' : [ 0x248, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x248, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'HasPhysicalVad' : [ 0x248, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x248, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x248, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x248, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'SessionCreationUnderway' : [ 0x248, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x248, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x248, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x248, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x248, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x248, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x248, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x248, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Unused3' : [ 0x248, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Unused4' : [ 0x248, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x248, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'Unused' : [ 0x248, ['BitField', dict(start_bit = 25, end_bit = 30, native_type='unsigned long')]], + 'Unused1' : [ 0x248, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Unused2' : [ 0x248, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x24c, ['long']], 'NextPageColor' : [ 0x250, ['unsigned short']], 'SubSystemMinorVersion' : [ 0x252, ['unsigned char']], @@ -493,12 +478,12 @@ nt_types = { 'IdealProcessor' : [ 0x1ba, ['unsigned char']], 'DisableBoost' : [ 0x1bb, ['unsigned char']], } ], - '__unnamed_10f8' : [ 0x208, { + '__unnamed_10f2' : [ 0x208, { 'FnArea' : [ 0x0, ['_FNSAVE_FORMAT']], 'FxArea' : [ 0x0, ['_FXSAVE_FORMAT']], } ], '_FX_SAVE_AREA' : [ 0x210, { - 'U' : [ 0x0, ['__unnamed_10f8']], + 'U' : [ 0x0, ['__unnamed_10f2']], 'NpxSavedCpu' : [ 0x208, ['unsigned long']], 'Cr0NpxState' : [ 0x20c, ['unsigned long']], } ], @@ -629,7 +614,7 @@ nt_types = { 'MaxInstructions' : [ 0x14, ['unsigned long']], 'TotalInstructions' : [ 0x18, ['unsigned long']], } ], - '__unnamed_1169' : [ 0x28, { + '__unnamed_1163' : [ 0x28, { 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], @@ -657,9 +642,9 @@ nt_types = { 'ProcessorLevel' : [ 0x4, ['unsigned short']], 'Processor' : [ 0x6, ['unsigned short']], 'ReturnStatus' : [ 0x8, ['long']], - 'u' : [ 0x10, ['__unnamed_1169']], + 'u' : [ 0x10, ['__unnamed_1163']], } ], - '__unnamed_1170' : [ 0x28, { + '__unnamed_116a' : [ 0x28, { 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], @@ -686,16 +671,16 @@ nt_types = { 'ProcessorLevel' : [ 0x4, ['unsigned short']], 'Processor' : [ 0x6, ['unsigned short']], 'ReturnStatus' : [ 0x8, ['long']], - 'u' : [ 0xc, ['__unnamed_1170']], + 'u' : [ 0xc, ['__unnamed_116a']], } ], - '__unnamed_1179' : [ 0x8, { + '__unnamed_1173' : [ 0x8, { 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], 'ActiveCount' : [ 0x0, ['unsigned short']], } ], '_VACB' : [ 0x18, { 'BaseAddress' : [ 0x0, ['pointer', ['void']]], 'SharedCacheMap' : [ 0x4, ['pointer', ['_SHARED_CACHE_MAP']]], - 'Overlay' : [ 0x8, ['__unnamed_1179']], + 'Overlay' : [ 0x8, ['__unnamed_1173']], 'LruList' : [ 0x10, ['_LIST_ENTRY']], } ], '_SHARED_CACHE_MAP' : [ 0x130, { @@ -754,11 +739,11 @@ nt_types = { 'UnusedBytes' : [ 0x6, ['unsigned char']], 'SegmentIndex' : [ 0x7, ['unsigned char']], } ], - '__unnamed_11a3' : [ 0x10, { + '__unnamed_119d' : [ 0x10, { 'FreeListsInUseUlong' : [ 0x0, ['array', 4, ['unsigned long']]], 'FreeListsInUseBytes' : [ 0x0, ['array', 16, ['unsigned char']]], } ], - '__unnamed_11a5' : [ 0x2, { + '__unnamed_119f' : [ 0x2, { 'FreeListsInUseTerminate' : [ 0x0, ['unsigned short']], 'DecommitCount' : [ 0x0, ['unsigned short']], } ], @@ -786,8 +771,8 @@ nt_types = { 'AlignMask' : [ 0x4c, ['unsigned long']], 'VirtualAllocdBlocks' : [ 0x50, ['_LIST_ENTRY']], 'Segments' : [ 0x58, ['array', 64, ['pointer', ['_HEAP_SEGMENT']]]], - 'u' : [ 0x158, ['__unnamed_11a3']], - 'u2' : [ 0x168, ['__unnamed_11a5']], + 'u' : [ 0x158, ['__unnamed_119d']], + 'u2' : [ 0x168, ['__unnamed_119f']], 'AllocatorBackTraceIndex' : [ 0x16a, ['unsigned short']], 'NonDedicatedListLength' : [ 0x16c, ['unsigned long']], 'LargeBlocksIndex' : [ 0x170, ['pointer', ['void']]], @@ -957,7 +942,7 @@ nt_types = { 'MmSectionFlags' : [ 0x24, ['pointer', ['_MMSECTION_FLAGS']]], 'MmSubSectionFlags' : [ 0x28, ['pointer', ['_MMSUBSECTION_FLAGS']]], } ], - '__unnamed_122d' : [ 0x4, { + '__unnamed_1224' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], } ], @@ -970,7 +955,7 @@ nt_types = { 'NumberOfSubsections' : [ 0x18, ['unsigned short']], 'FlushInProgressCount' : [ 0x1a, ['unsigned short']], 'NumberOfUserReferences' : [ 0x1c, ['unsigned long']], - 'u' : [ 0x20, ['__unnamed_122d']], + 'u' : [ 0x20, ['__unnamed_1224']], 'FilePointer' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], 'WaitingForDeletion' : [ 0x28, ['pointer', ['_EVENT_COUNTER']]], 'ModifiedWriteCount' : [ 0x2c, ['unsigned short']], @@ -990,13 +975,13 @@ nt_types = { 'NextHandleNeedingPool' : [ 0x38, ['unsigned long']], 'HandleCount' : [ 0x3c, ['long']], 'Flags' : [ 0x40, ['unsigned long']], - 'StrictFIFO' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], } ], '_POOL_HEADER' : [ 0x8, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16)]], - 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'ProcessBilled' : [ 0x4, ['pointer', ['_EPROCESS']]], 'PoolTag' : [ 0x4, ['unsigned long']], @@ -1036,14 +1021,14 @@ nt_types = { 'Info' : [ 0x38, ['EX_QUEUE_WORKER_INFO']], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20)]], - 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20, native_type='unsigned long')]], + 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], } ], '_HEAP_TAG_ENTRY' : [ 0x40, { 'Allocs' : [ 0x0, ['unsigned long']], @@ -1128,7 +1113,7 @@ nt_types = { 'NumberOfSubsections' : [ 0x18, ['unsigned short']], 'FlushInProgressCount' : [ 0x1a, ['unsigned short']], 'NumberOfUserReferences' : [ 0x1c, ['unsigned long']], - 'u' : [ 0x20, ['__unnamed_122d']], + 'u' : [ 0x20, ['__unnamed_1224']], 'FilePointer' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], 'WaitingForDeletion' : [ 0x28, ['pointer', ['_EVENT_COUNTER']]], 'ModifiedWriteCount' : [ 0x2c, ['unsigned short']], @@ -1246,37 +1231,37 @@ nt_types = { 'OldIrql' : [ 0x8, ['unsigned char']], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'HadUserReference' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'filler' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'HadUserReference' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'filler' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 32, native_type='unsigned long')]], } ], '_DEFERRED_WRITE' : [ 0x28, { 'NodeTypeCode' : [ 0x0, ['short']], @@ -1314,14 +1299,14 @@ nt_types = { 'EffectiveOnly' : [ 0x5, ['unsigned char']], 'ImpersonationLevel' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], } ], - '__unnamed_12cc' : [ 0x4, { + '__unnamed_12c3' : [ 0x4, { 'LegacyDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], 'PendingDeviceRelations' : [ 0x0, ['pointer', ['_DEVICE_RELATIONS']]], } ], - '__unnamed_12ce' : [ 0x4, { + '__unnamed_12c5' : [ 0x4, { 'NextResourceDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], } ], - '__unnamed_12d2' : [ 0x10, { + '__unnamed_12c9' : [ 0x10, { 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], 'ListEntry' : [ 0x4, ['_LIST_ENTRY']], 'SerialNumber' : [ 0xc, ['pointer', ['unsigned short']]], @@ -1363,22 +1348,22 @@ nt_types = { 'QueryTranslatorMask' : [ 0xda, ['unsigned short']], 'NoArbiterMask' : [ 0xdc, ['unsigned short']], 'QueryArbiterMask' : [ 0xde, ['unsigned short']], - 'OverUsed1' : [ 0xe0, ['__unnamed_12cc']], - 'OverUsed2' : [ 0xe4, ['__unnamed_12ce']], + 'OverUsed1' : [ 0xe0, ['__unnamed_12c3']], + 'OverUsed2' : [ 0xe4, ['__unnamed_12c5']], 'BootResources' : [ 0xe8, ['pointer', ['_CM_RESOURCE_LIST']]], 'CapabilityFlags' : [ 0xec, ['unsigned long']], - 'DockInfo' : [ 0xf0, ['__unnamed_12d2']], + 'DockInfo' : [ 0xf0, ['__unnamed_12c9']], 'DisableableDepends' : [ 0x100, ['unsigned long']], 'PendedSetInterfaceState' : [ 0x104, ['_LIST_ENTRY']], 'LegacyBusListEntry' : [ 0x10c, ['_LIST_ENTRY']], 'DriverUnloadRetryCount' : [ 0x114, ['unsigned long']], } ], - '__unnamed_12d7' : [ 0x38, { + '__unnamed_12ce' : [ 0x38, { 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], 'Resource' : [ 0x0, ['_ERESOURCE']], } ], '_HEAP_LOCK' : [ 0x38, { - 'Lock' : [ 0x0, ['__unnamed_12d7']], + 'Lock' : [ 0x0, ['__unnamed_12ce']], } ], '_KPCR' : [ 0xd70, { 'NtTib' : [ 0x0, ['_NT_TIB']], @@ -1428,13 +1413,13 @@ nt_types = { 'BasePage' : [ 0x0, ['unsigned long']], 'PageCount' : [ 0x4, ['unsigned long']], } ], - '__unnamed_12f6' : [ 0x4, { + '__unnamed_12ed' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], } ], '_MM_SESSION_SPACE' : [ 0x1278, { 'ReferenceCount' : [ 0x0, ['unsigned long']], - 'u' : [ 0x4, ['__unnamed_12f6']], + 'u' : [ 0x4, ['__unnamed_12ed']], 'SessionId' : [ 0x8, ['unsigned long']], 'SessionPageDirectoryIndex' : [ 0xc, ['unsigned long']], 'GlobalVirtualAddress' : [ 0x10, ['pointer', ['_MM_SESSION_SPACE']]], @@ -1567,7 +1552,7 @@ nt_types = { '_DBGKD_GET_CONTEXT' : [ 0x4, { 'Unused' : [ 0x0, ['unsigned long']], } ], - '__unnamed_1321' : [ 0x4, { + '__unnamed_1317' : [ 0x4, { 'Long' : [ 0x0, ['unsigned long']], 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], 'Flush' : [ 0x0, ['_HARDWARE_PTE']], @@ -1578,15 +1563,15 @@ nt_types = { 'List' : [ 0x0, ['_MMPTE_LIST']], } ], '_MMPTE' : [ 0x4, { - 'u' : [ 0x0, ['__unnamed_1321']], + 'u' : [ 0x0, ['__unnamed_1317']], } ], '_MMPTE_SOFTWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { 'ListSize' : [ 0x0, ['unsigned long']], @@ -1616,13 +1601,13 @@ nt_types = { 'Peak' : [ 0x8, ['unsigned long']], 'Return' : [ 0xc, ['unsigned long']], } ], - '__unnamed_133a' : [ 0x50, { + '__unnamed_1333' : [ 0x50, { 'CellData' : [ 0x0, ['_CELL_DATA']], 'List' : [ 0x0, ['array', 1, ['unsigned long']]], } ], '_CM_CACHED_VALUE_INDEX' : [ 0x54, { 'CellIndex' : [ 0x0, ['unsigned long']], - 'Data' : [ 0x4, ['__unnamed_133a']], + 'Data' : [ 0x4, ['__unnamed_1333']], } ], '_KSEMAPHORE' : [ 0x14, { 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], @@ -1750,15 +1735,15 @@ nt_types = { 'Volume' : [ 0x44, ['_LIST_ENTRY']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'AddressSpaceBeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16)]], - 'AllowWorkingSetAdjustment' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'MemoryPriority' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'AddressSpaceBeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned long')]], + 'AllowWorkingSetAdjustment' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'MemoryPriority' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_TERMINATION_PORT' : [ 0x8, { 'Next' : [ 0x0, ['pointer', ['_TERMINATION_PORT']]], @@ -1821,8 +1806,8 @@ nt_types = { 'Revision' : [ 0x0, ['unsigned long']], 'DynamicThrottle' : [ 0x4, ['unsigned char']], 'Spare' : [ 0x5, ['array', 3, ['unsigned char']]], - 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'PolicyCount' : [ 0xc, ['unsigned long']], 'Policy' : [ 0x10, ['array', 3, ['_PROCESSOR_POWER_POLICY_INFO']]], } ], @@ -1877,10 +1862,10 @@ nt_types = { 'RegisterArea' : [ 0x1c, ['array', 80, ['unsigned char']]], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'SYSTEM_POWER_LEVEL' : [ 0x18, { @@ -1929,12 +1914,12 @@ nt_types = { 'GpValue' : [ 0x34, ['unsigned long']], } ], '_MMPTE_LIST' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_CMHIVE' : [ 0x49c, { 'Hive' : [ 0x0, ['_HHIVE']], @@ -2013,11 +1998,11 @@ nt_types = { 'Name' : [ 0xc, ['array', 1, ['unsigned short']]], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Filler0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 4)]], - 'HasWsLock' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Filler0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned long')]], + 'HasWsLock' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x18, { 'Version' : [ 0x0, ['unsigned short']], @@ -2042,7 +2027,7 @@ nt_types = { 'DriverUnload' : [ 0x34, ['pointer', ['void']]], 'MajorFunction' : [ 0x38, ['array', 28, ['pointer', ['void']]]], } ], - '__unnamed_13ff' : [ 0x28, { + '__unnamed_13f8' : [ 0x28, { 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], } ], @@ -2061,7 +2046,7 @@ nt_types = { 'DeviceExtension' : [ 0x28, ['pointer', ['void']]], 'DeviceType' : [ 0x2c, ['unsigned long']], 'StackSize' : [ 0x30, ['unsigned char']], - 'Queue' : [ 0x34, ['__unnamed_13ff']], + 'Queue' : [ 0x34, ['__unnamed_13f8']], 'AlignmentRequirement' : [ 0x5c, ['unsigned long']], 'DeviceQueue' : [ 0x60, ['_KDEVICE_QUEUE']], 'Dpc' : [ 0x74, ['_KDPC']], @@ -2179,13 +2164,13 @@ nt_types = { 'QueryNameProcedure' : [ 0x44, ['pointer', ['void']]], 'OkayToCloseProcedure' : [ 0x48, ['pointer', ['void']]], } ], - '__unnamed_1445' : [ 0x4, { + '__unnamed_143e' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], } ], '_SUBSECTION' : [ 0x20, { 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], - 'u' : [ 0x4, ['__unnamed_1445']], + 'u' : [ 0x4, ['__unnamed_143e']], 'StartingSector' : [ 0x8, ['unsigned long']], 'NumberOfFullSectors' : [ 0xc, ['unsigned long']], 'SubsectionBase' : [ 0x10, ['pointer', ['_MMPTE']]], @@ -2203,19 +2188,19 @@ nt_types = { 'ArbitraryUserPointer' : [ 0x14, ['pointer', ['void']]], 'Self' : [ 0x18, ['pointer', ['_NT_TIB']]], } ], - '__unnamed_1453' : [ 0x4, { + '__unnamed_144c' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], } ], - '__unnamed_1456' : [ 0x4, { + '__unnamed_144f' : [ 0x4, { 'LongFlags2' : [ 0x0, ['unsigned long']], 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], } ], - '__unnamed_1459' : [ 0x8, { + '__unnamed_1452' : [ 0x8, { 'List' : [ 0x0, ['_LIST_ENTRY']], 'Secured' : [ 0x0, ['_MMADDRESS_LIST']], } ], - '__unnamed_145f' : [ 0x4, { + '__unnamed_1458' : [ 0x4, { 'Banked' : [ 0x0, ['pointer', ['_MMBANKED_SECTION']]], 'ExtendedInfo' : [ 0x0, ['pointer', ['_MMEXTEND_INFO']]], } ], @@ -2225,25 +2210,25 @@ nt_types = { 'Parent' : [ 0x8, ['pointer', ['_MMVAD']]], 'LeftChild' : [ 0xc, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x10, ['pointer', ['_MMVAD']]], - 'u' : [ 0x14, ['__unnamed_1453']], + 'u' : [ 0x14, ['__unnamed_144c']], 'ControlArea' : [ 0x18, ['pointer', ['_CONTROL_AREA']]], 'FirstPrototypePte' : [ 0x1c, ['pointer', ['_MMPTE']]], 'LastContiguousPte' : [ 0x20, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x24, ['__unnamed_1456']], - 'u3' : [ 0x28, ['__unnamed_1459']], - 'u4' : [ 0x30, ['__unnamed_145f']], + 'u2' : [ 0x24, ['__unnamed_144f']], + 'u3' : [ 0x28, ['__unnamed_1452']], + 'u4' : [ 0x30, ['__unnamed_1458']], } ], '_MMVAD_FLAGS' : [ 0x4, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19)]], - 'PhysicalMapping' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'ImageMap' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'UserPhysicalPages' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'WriteWatch' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19, native_type='unsigned long')]], + 'PhysicalMapping' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ImageMap' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'UserPhysicalPages' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'WriteWatch' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_POOL_DESCRIPTOR' : [ 0x1028, { 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], @@ -2257,6 +2242,21 @@ nt_types = { 'PendingFrees' : [ 0x20, ['pointer', ['void']]], 'PendingFreeDepth' : [ 0x24, ['long']], 'ListHeads' : [ 0x28, ['array', 512, ['_LIST_ENTRY']]], +} ], + '_HARDWARE_PTE' : [ 0x4, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_PEB_LDR_DATA' : [ 0x28, { 'Length' : [ 0x0, ['unsigned long']], @@ -2349,12 +2349,12 @@ nt_types = { 'FaultingVa' : [ 0x4, ['pointer', ['void']]], } ], '_MMPTE_SUBSECTION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 31)]], - 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 31, native_type='unsigned long')]], + 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_VI_DEADLOCK_NODE' : [ 0x68, { 'Parent' : [ 0x0, ['pointer', ['_VI_DEADLOCK_NODE']]], @@ -2364,9 +2364,9 @@ nt_types = { 'FreeListEntry' : [ 0x14, ['_LIST_ENTRY']], 'Root' : [ 0x1c, ['pointer', ['_VI_DEADLOCK_RESOURCE']]], 'ThreadEntry' : [ 0x20, ['pointer', ['_VI_DEADLOCK_THREAD']]], - 'Active' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SequenceNumber' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'Active' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'StackTrace' : [ 0x28, ['array', 8, ['pointer', ['void']]]], 'ParentStackTrace' : [ 0x48, ['array', 8, ['pointer', ['void']]]], } ], @@ -2522,18 +2522,18 @@ nt_types = { 'Sacl' : [ 0xc, ['pointer', ['_ACL']]], 'Dacl' : [ 0x10, ['pointer', ['_ACL']]], } ], - '__unnamed_14cf' : [ 0x8, { + '__unnamed_14ca' : [ 0x8, { 'UserData' : [ 0x0, ['pointer', ['void']]], 'Owner' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_14d1' : [ 0x8, { + '__unnamed_14cc' : [ 0x8, { 'ListHead' : [ 0x0, ['_LIST_ENTRY']], } ], '_RTLP_RANGE_LIST_ENTRY' : [ 0x28, { 'Start' : [ 0x0, ['unsigned long long']], 'End' : [ 0x8, ['unsigned long long']], - 'Allocated' : [ 0x10, ['__unnamed_14cf']], - 'Merged' : [ 0x10, ['__unnamed_14d1']], + 'Allocated' : [ 0x10, ['__unnamed_14ca']], + 'Merged' : [ 0x10, ['__unnamed_14cc']], 'Attributes' : [ 0x18, ['unsigned char']], 'PublicFlags' : [ 0x19, ['unsigned char']], 'PrivateFlags' : [ 0x1a, ['unsigned short']], @@ -2661,34 +2661,34 @@ nt_types = { 'V86Fs' : [ 0x84, ['unsigned long']], 'V86Gs' : [ 0x88, ['unsigned long']], } ], - '__unnamed_14fa' : [ 0x4, { + '__unnamed_14f5' : [ 0x4, { 'BaseMid' : [ 0x0, ['unsigned char']], 'Flags1' : [ 0x1, ['unsigned char']], 'Flags2' : [ 0x2, ['unsigned char']], 'BaseHi' : [ 0x3, ['unsigned char']], } ], - '__unnamed_1501' : [ 0x4, { - 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + '__unnamed_14fc' : [ 0x4, { + 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], - '__unnamed_1503' : [ 0x4, { - 'Bytes' : [ 0x0, ['__unnamed_14fa']], - 'Bits' : [ 0x0, ['__unnamed_1501']], + '__unnamed_14fe' : [ 0x4, { + 'Bytes' : [ 0x0, ['__unnamed_14f5']], + 'Bits' : [ 0x0, ['__unnamed_14fc']], } ], '_KGDTENTRY' : [ 0x8, { 'LimitLow' : [ 0x0, ['unsigned short']], 'BaseLow' : [ 0x2, ['unsigned short']], - 'HighWord' : [ 0x4, ['__unnamed_1503']], + 'HighWord' : [ 0x4, ['__unnamed_14fe']], } ], - '__unnamed_150d' : [ 0x5, { + '__unnamed_1508' : [ 0x5, { 'Acquired' : [ 0x0, ['unsigned char']], 'CacheLineSize' : [ 0x1, ['unsigned char']], 'LatencyTimer' : [ 0x2, ['unsigned char']], @@ -2725,51 +2725,51 @@ nt_types = { 'ChildWaitWakeCount' : [ 0xa4, ['unsigned long']], 'PreservedConfig' : [ 0xa8, ['pointer', ['_PCI_COMMON_CONFIG']]], 'Lock' : [ 0xac, ['_PCI_LOCK']], - 'HotPlugParameters' : [ 0xb4, ['__unnamed_150d']], + 'HotPlugParameters' : [ 0xb4, ['__unnamed_1508']], 'BusHackFlags' : [ 0xbc, ['unsigned long']], } ], - '__unnamed_1511' : [ 0xc, { + '__unnamed_150c' : [ 0xc, { 'Start' : [ 0x0, ['_LARGE_INTEGER']], 'Length' : [ 0x8, ['unsigned long']], } ], - '__unnamed_1513' : [ 0xc, { + '__unnamed_150e' : [ 0xc, { 'Level' : [ 0x0, ['unsigned long']], 'Vector' : [ 0x4, ['unsigned long']], 'Affinity' : [ 0x8, ['unsigned long']], } ], - '__unnamed_1515' : [ 0xc, { + '__unnamed_1510' : [ 0xc, { 'Channel' : [ 0x0, ['unsigned long']], 'Port' : [ 0x4, ['unsigned long']], 'Reserved1' : [ 0x8, ['unsigned long']], } ], - '__unnamed_1517' : [ 0xc, { + '__unnamed_1512' : [ 0xc, { 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], } ], - '__unnamed_1519' : [ 0xc, { + '__unnamed_1514' : [ 0xc, { 'Start' : [ 0x0, ['unsigned long']], 'Length' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned long']], } ], - '__unnamed_151b' : [ 0xc, { + '__unnamed_1516' : [ 0xc, { 'DataSize' : [ 0x0, ['unsigned long']], 'Reserved1' : [ 0x4, ['unsigned long']], 'Reserved2' : [ 0x8, ['unsigned long']], } ], - '__unnamed_151d' : [ 0xc, { - 'Generic' : [ 0x0, ['__unnamed_1511']], - 'Port' : [ 0x0, ['__unnamed_1511']], - 'Interrupt' : [ 0x0, ['__unnamed_1513']], - 'Memory' : [ 0x0, ['__unnamed_1511']], - 'Dma' : [ 0x0, ['__unnamed_1515']], - 'DevicePrivate' : [ 0x0, ['__unnamed_1517']], - 'BusNumber' : [ 0x0, ['__unnamed_1519']], - 'DeviceSpecificData' : [ 0x0, ['__unnamed_151b']], + '__unnamed_1518' : [ 0xc, { + 'Generic' : [ 0x0, ['__unnamed_150c']], + 'Port' : [ 0x0, ['__unnamed_150c']], + 'Interrupt' : [ 0x0, ['__unnamed_150e']], + 'Memory' : [ 0x0, ['__unnamed_150c']], + 'Dma' : [ 0x0, ['__unnamed_1510']], + 'DevicePrivate' : [ 0x0, ['__unnamed_1512']], + 'BusNumber' : [ 0x0, ['__unnamed_1514']], + 'DeviceSpecificData' : [ 0x0, ['__unnamed_1516']], } ], '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x10, { 'Type' : [ 0x0, ['unsigned char']], 'ShareDisposition' : [ 0x1, ['unsigned char']], 'Flags' : [ 0x2, ['unsigned short']], - 'u' : [ 0x4, ['__unnamed_151d']], + 'u' : [ 0x4, ['__unnamed_1518']], } ], '_WAIT_CONTEXT_BLOCK' : [ 0x28, { 'WaitQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], @@ -2783,11 +2783,11 @@ nt_types = { '_CM_KEY_CONTROL_BLOCK' : [ 0x48, { 'RefCount' : [ 0x0, ['unsigned short']], 'Flags' : [ 0x2, ['unsigned short']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x8, ['unsigned long']], 'NextHash' : [ 0xc, ['pointer', ['_CM_KEY_HASH']]], @@ -2859,20 +2859,20 @@ nt_types = { 'KeyHive' : [ 0x8, ['pointer', ['_HHIVE']]], 'KeyCell' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1555' : [ 0x4, { + '__unnamed_1550' : [ 0x4, { 'MasterIrp' : [ 0x0, ['pointer', ['_IRP']]], 'IrpCount' : [ 0x0, ['long']], 'SystemBuffer' : [ 0x0, ['pointer', ['void']]], } ], - '__unnamed_155c' : [ 0x8, { + '__unnamed_1557' : [ 0x8, { 'UserApcRoutine' : [ 0x0, ['pointer', ['void']]], 'UserApcContext' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_155e' : [ 0x8, { - 'AsynchronousParameters' : [ 0x0, ['__unnamed_155c']], + '__unnamed_1559' : [ 0x8, { + 'AsynchronousParameters' : [ 0x0, ['__unnamed_1557']], 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], } ], - '__unnamed_1563' : [ 0x28, { + '__unnamed_155e' : [ 0x28, { 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], 'DriverContext' : [ 0x0, ['array', 4, ['pointer', ['void']]]], 'Thread' : [ 0x10, ['pointer', ['_ETHREAD']]], @@ -2882,8 +2882,8 @@ nt_types = { 'PacketType' : [ 0x20, ['unsigned long']], 'OriginalFileObject' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], } ], - '__unnamed_1565' : [ 0x30, { - 'Overlay' : [ 0x0, ['__unnamed_1563']], + '__unnamed_1560' : [ 0x30, { + 'Overlay' : [ 0x0, ['__unnamed_155e']], 'Apc' : [ 0x0, ['_KAPC']], 'CompletionKey' : [ 0x0, ['pointer', ['void']]], } ], @@ -2892,7 +2892,7 @@ nt_types = { 'Size' : [ 0x2, ['unsigned short']], 'MdlAddress' : [ 0x4, ['pointer', ['_MDL']]], 'Flags' : [ 0x8, ['unsigned long']], - 'AssociatedIrp' : [ 0xc, ['__unnamed_1555']], + 'AssociatedIrp' : [ 0xc, ['__unnamed_1550']], 'ThreadListEntry' : [ 0x10, ['_LIST_ENTRY']], 'IoStatus' : [ 0x18, ['_IO_STATUS_BLOCK']], 'RequestorMode' : [ 0x20, ['unsigned char']], @@ -2905,10 +2905,10 @@ nt_types = { 'AllocationFlags' : [ 0x27, ['unsigned char']], 'UserIosb' : [ 0x28, ['pointer', ['_IO_STATUS_BLOCK']]], 'UserEvent' : [ 0x2c, ['pointer', ['_KEVENT']]], - 'Overlay' : [ 0x30, ['__unnamed_155e']], + 'Overlay' : [ 0x30, ['__unnamed_1559']], 'CancelRoutine' : [ 0x38, ['pointer', ['void']]], 'UserBuffer' : [ 0x3c, ['pointer', ['void']]], - 'Tail' : [ 0x40, ['__unnamed_1565']], + 'Tail' : [ 0x40, ['__unnamed_1560']], } ], '_PCI_LOCK' : [ 0x8, { 'Atom' : [ 0x0, ['unsigned long']], @@ -2918,13 +2918,13 @@ nt_types = { 'Cell' : [ 0x0, ['unsigned long']], 'CachedSecurity' : [ 0x4, ['pointer', ['_CM_KEY_SECURITY_CACHE']]], } ], - '__unnamed_156e' : [ 0x4, { + '__unnamed_1569' : [ 0x4, { 'PhysicalAddress' : [ 0x0, ['unsigned long']], 'VirtualSize' : [ 0x0, ['unsigned long']], } ], '_IMAGE_SECTION_HEADER' : [ 0x28, { 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], - 'Misc' : [ 0x8, ['__unnamed_156e']], + 'Misc' : [ 0x8, ['__unnamed_1569']], 'VirtualAddress' : [ 0xc, ['unsigned long']], 'SizeOfRawData' : [ 0x10, ['unsigned long']], 'PointerToRawData' : [ 0x14, ['unsigned long']], @@ -2934,14 +2934,14 @@ nt_types = { 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], 'Characteristics' : [ 0x24, ['unsigned long']], } ], - '__unnamed_1574' : [ 0x4, { + '__unnamed_156f' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], } ], '_POP_ACTION_TRIGGER' : [ 0xc, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyInitiatePowerActionAPI', 4: 'PolicySetPowerStateAPI', 5: 'PolicyImmediateDozeS4', 6: 'PolicySystemIdle'})]], 'Flags' : [ 0x4, ['unsigned char']], 'Spare' : [ 0x5, ['array', 3, ['unsigned char']]], - 'Battery' : [ 0x8, ['__unnamed_1574']], + 'Battery' : [ 0x8, ['__unnamed_156f']], 'Wait' : [ 0x8, ['pointer', ['_POP_TRIGGER_WAIT']]], } ], '_FAST_IO_DISPATCH' : [ 0x70, { @@ -2994,31 +2994,31 @@ nt_types = { 'NewCell' : [ 0x4, ['unsigned long']], } ], '_PCI_PMC' : [ 0x2, { - 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], 'Support' : [ 0x1, ['_PM_SUPPORT']], } ], '_DBGKD_CONTINUE' : [ 0x4, { 'ContinueStatus' : [ 0x0, ['long']], } ], '_MMPTE_PROTOTYPE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], - '__unnamed_15db' : [ 0x4, { + '__unnamed_15d6' : [ 0x4, { 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], 'Long' : [ 0x0, ['unsigned long']], 'e1' : [ 0x0, ['_MMWSLENTRY']], } ], '_MMWSLE' : [ 0x4, { - 'u1' : [ 0x0, ['__unnamed_15db']], + 'u1' : [ 0x0, ['__unnamed_15d6']], } ], '_EXCEPTION_POINTERS' : [ 0x8, { 'ExceptionRecord' : [ 0x0, ['pointer', ['_EXCEPTION_RECORD']]], @@ -3088,8 +3088,8 @@ nt_types = { } ], '_VI_DEADLOCK_RESOURCE' : [ 0x80, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockFastMutex', 3: 'VfDeadlockFastMutexUnsafe', 4: 'VfDeadlockSpinLock', 5: 'VfDeadlockQueuedSpinLock', 6: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer', ['void']]], 'ThreadOwner' : [ 0xc, ['pointer', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x10, ['_LIST_ENTRY']], @@ -3125,23 +3125,23 @@ nt_types = { 'Flink' : [ 0x8, ['unsigned long']], 'Blink' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1607' : [ 0x4, { + '__unnamed_1603' : [ 0x4, { 'Spare' : [ 0x0, ['array', 4, ['unsigned char']]], } ], - '__unnamed_1609' : [ 0x4, { + '__unnamed_1605' : [ 0x4, { 'PrimaryBus' : [ 0x0, ['unsigned char']], 'SecondaryBus' : [ 0x1, ['unsigned char']], 'SubordinateBus' : [ 0x2, ['unsigned char']], - 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], } ], 'PCI_HEADER_TYPE_DEPENDENT' : [ 0x4, { - 'type0' : [ 0x0, ['__unnamed_1607']], - 'type1' : [ 0x0, ['__unnamed_1609']], - 'type2' : [ 0x0, ['__unnamed_1609']], + 'type0' : [ 0x0, ['__unnamed_1603']], + 'type1' : [ 0x0, ['__unnamed_1605']], + 'type2' : [ 0x0, ['__unnamed_1605']], } ], '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { 'BusDataType' : [ 0x0, ['unsigned long']], @@ -3262,14 +3262,14 @@ nt_types = { 'Align16Byte' : [ 0x200, ['array', 8, ['unsigned char']]], } ], '_MMWSLENTRY' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_OBJECT_DIRECTORY' : [ 0xa4, { 'HashBuckets' : [ 0x0, ['array', 37, ['pointer', ['_OBJECT_DIRECTORY_ENTRY']]]], @@ -3367,11 +3367,11 @@ nt_types = { 'Abandoned' : [ 0x1c, ['unsigned char']], 'ApcDisable' : [ 0x1d, ['unsigned char']], } ], - '__unnamed_167f' : [ 0x4, { + '__unnamed_167b' : [ 0x4, { 'ImageCommitment' : [ 0x0, ['unsigned long']], 'CreatingProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], } ], - '__unnamed_1683' : [ 0x4, { + '__unnamed_167f' : [ 0x4, { 'ImageInformation' : [ 0x0, ['pointer', ['_SECTION_IMAGE_INFORMATION']]], 'FirstMappedVa' : [ 0x0, ['pointer', ['void']]], } ], @@ -3386,8 +3386,8 @@ nt_types = { 'ExtendInfo' : [ 0x20, ['pointer', ['_MMEXTEND_INFO']]], 'SystemImageBase' : [ 0x24, ['pointer', ['void']]], 'BasedAddress' : [ 0x28, ['pointer', ['void']]], - 'u1' : [ 0x2c, ['__unnamed_167f']], - 'u2' : [ 0x30, ['__unnamed_1683']], + 'u1' : [ 0x2c, ['__unnamed_167b']], + 'u2' : [ 0x30, ['__unnamed_167f']], 'PrototypePte' : [ 0x34, ['pointer', ['_MMPTE']]], 'ThePtes' : [ 0x38, ['array', 1, ['_MMPTE']]], } ], @@ -3621,7 +3621,7 @@ nt_types = { 'ExtensionType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1768116272: 'PciPdoExtensionType', 1768116273: 'PciFdoExtensionType', 1768116274: 'PciArb_Io', 1768116275: 'PciArb_Memory', 1768116276: 'PciArb_Interrupt', 1768116277: 'PciArb_BusNumber', 1768116278: 'PciTrans_Interrupt', 1768116279: 'PciInterface_BusHandler', 1768116280: 'PciInterface_IntRouteHandler', 1768116281: 'PciInterface_PciCb', 1768116282: 'PciInterface_LegacyDeviceDetection', 1768116283: 'PciInterface_PmeHandler', 1768116284: 'PciInterface_DevicePresent', 1768116285: 'PciInterface_NativeIde', 1768116286: 'PciInterface_AgpTarget'})]], 'Destructor' : [ 0x8, ['pointer', ['void']]], } ], - '__unnamed_16ca' : [ 0x30, { + '__unnamed_16c6' : [ 0x30, { 'type0' : [ 0x0, ['_PCI_HEADER_TYPE_0']], 'type1' : [ 0x0, ['_PCI_HEADER_TYPE_1']], 'type2' : [ 0x0, ['_PCI_HEADER_TYPE_2']], @@ -3639,7 +3639,7 @@ nt_types = { 'LatencyTimer' : [ 0xd, ['unsigned char']], 'HeaderType' : [ 0xe, ['unsigned char']], 'BIST' : [ 0xf, ['unsigned char']], - 'u' : [ 0x10, ['__unnamed_16ca']], + 'u' : [ 0x10, ['__unnamed_16c6']], 'DeviceSpecific' : [ 0x40, ['array', 192, ['unsigned char']]], } ], '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { @@ -3774,20 +3774,20 @@ nt_types = { 'Parent' : [ 0x8, ['pointer', ['_MMVAD']]], 'LeftChild' : [ 0xc, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x10, ['pointer', ['_MMVAD']]], - 'u' : [ 0x14, ['__unnamed_1453']], + 'u' : [ 0x14, ['__unnamed_144c']], 'ControlArea' : [ 0x18, ['pointer', ['_CONTROL_AREA']]], 'FirstPrototypePte' : [ 0x1c, ['pointer', ['_MMPTE']]], 'LastContiguousPte' : [ 0x20, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x24, ['__unnamed_1456']], + 'u2' : [ 0x24, ['__unnamed_144f']], } ], - '__unnamed_16ff' : [ 0x8, { + '__unnamed_16fb' : [ 0x8, { 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], 'LastByte' : [ 0x0, ['_LARGE_INTEGER']], } ], '_MMMOD_WRITER_MDL_ENTRY' : [ 0x58, { 'Links' : [ 0x0, ['_LIST_ENTRY']], 'WriteOffset' : [ 0x8, ['_LARGE_INTEGER']], - 'u' : [ 0x10, ['__unnamed_16ff']], + 'u' : [ 0x10, ['__unnamed_16fb']], 'Irp' : [ 0x18, ['pointer', ['_IRP']]], 'LastPageToWrite' : [ 0x1c, ['unsigned long']], 'PagingListHead' : [ 0x20, ['pointer', ['_MMMOD_WRITER_LISTHEAD']]], @@ -3837,9 +3837,9 @@ nt_types = { 'Parent' : [ 0x8, ['pointer', ['_MMVAD']]], 'LeftChild' : [ 0xc, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x10, ['pointer', ['_MMVAD']]], - 'u' : [ 0x14, ['__unnamed_1453']], + 'u' : [ 0x14, ['__unnamed_144c']], } ], - '__unnamed_171b' : [ 0x2c, { + '__unnamed_1717' : [ 0x2c, { 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], } ], @@ -3856,7 +3856,7 @@ nt_types = { 'SubjectSecurityContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], 'SecurityDescriptor' : [ 0x2c, ['pointer', ['void']]], 'AuxData' : [ 0x30, ['pointer', ['void']]], - 'Privileges' : [ 0x34, ['__unnamed_171b']], + 'Privileges' : [ 0x34, ['__unnamed_1717']], 'AuditPrivileges' : [ 0x60, ['unsigned char']], 'ObjectName' : [ 0x64, ['_UNICODE_STRING']], 'ObjectTypeName' : [ 0x6c, ['_UNICODE_STRING']], @@ -3872,10 +3872,10 @@ nt_types = { 'Data' : [ 0x20, ['_PLUGPLAY_EVENT_BLOCK']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], } ], '_PNP_DEVICE_EVENT_LIST' : [ 0x4c, { 'Status' : [ 0x0, ['long']], @@ -3888,15 +3888,15 @@ nt_types = { 'SpecialRegisters' : [ 0x2cc, ['_KSPECIAL_REGISTERS']], } ], '_MMPTE_TRANSITION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_TOKEN_SOURCE' : [ 0x10, { 'SourceName' : [ 0x0, ['array', 8, ['unsigned char']]], @@ -3908,15 +3908,15 @@ nt_types = { 'Buffer' : [ 0x4, ['pointer', ['unsigned char']]], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_flags' : [ 0x1, { 'Removable' : [ 0x0, ['unsigned char']], @@ -3935,9 +3935,9 @@ nt_types = { 'DemotePercent' : [ 0xc, ['unsigned char']], 'PromotePercent' : [ 0xd, ['unsigned char']], 'Spare' : [ 0xe, ['array', 2, ['unsigned char']]], - 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_GUID' : [ 0x10, { 'Data1' : [ 0x0, ['unsigned long']], @@ -4055,42 +4055,42 @@ nt_types = { 'ActiveFrame' : [ 0x8, ['pointer', ['void']]], 'FrameListCache' : [ 0xc, ['_LIST_ENTRY']], } ], - '__unnamed_17a1' : [ 0x4, { + '__unnamed_179d' : [ 0x4, { 'Flink' : [ 0x0, ['unsigned long']], 'WsIndex' : [ 0x0, ['unsigned long']], 'Event' : [ 0x0, ['pointer', ['_KEVENT']]], 'ReadStatus' : [ 0x0, ['long']], 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], } ], - '__unnamed_17a3' : [ 0x4, { + '__unnamed_179f' : [ 0x4, { 'Blink' : [ 0x0, ['unsigned long']], 'ShareCount' : [ 0x0, ['unsigned long']], } ], - '__unnamed_17a6' : [ 0x4, { + '__unnamed_17a2' : [ 0x4, { 'ShortFlags' : [ 0x0, ['unsigned short']], 'ReferenceCount' : [ 0x2, ['unsigned short']], } ], - '__unnamed_17a8' : [ 0x4, { + '__unnamed_17a4' : [ 0x4, { 'e1' : [ 0x0, ['_MMPFNENTRY']], - 'e2' : [ 0x0, ['__unnamed_17a6']], + 'e2' : [ 0x0, ['__unnamed_17a2']], } ], - '__unnamed_17ae' : [ 0x4, { + '__unnamed_17aa' : [ 0x4, { 'EntireFrame' : [ 0x0, ['unsigned long']], - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 26)]], - 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'LockCharged' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'KernelStack' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 26, native_type='unsigned long')]], + 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'LockCharged' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'KernelStack' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_MMPFN' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_17a1']], + 'u1' : [ 0x0, ['__unnamed_179d']], 'PteAddress' : [ 0x4, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x8, ['__unnamed_17a3']], - 'u3' : [ 0xc, ['__unnamed_17a8']], + 'u2' : [ 0x8, ['__unnamed_179f']], + 'u3' : [ 0xc, ['__unnamed_17a4']], 'OriginalPte' : [ 0x10, ['_MMPTE']], - 'u4' : [ 0x14, ['__unnamed_17ae']], + 'u4' : [ 0x14, ['__unnamed_17aa']], } ], '_MMWSLE_HASH' : [ 0x8, { 'Key' : [ 0x0, ['pointer', ['void']]], @@ -4169,47 +4169,47 @@ nt_types = { 'Count' : [ 0x0, ['unsigned long']], 'HashKey' : [ 0x4, ['array', 1, ['unsigned long']]], } ], - '__unnamed_17d2' : [ 0x10, { + '__unnamed_17ce' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'FileAttributes' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'EaLength' : [ 0xc, ['unsigned long']], } ], - '__unnamed_17d6' : [ 0x10, { + '__unnamed_17d2' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'Parameters' : [ 0xc, ['pointer', ['_NAMED_PIPE_CREATE_PARAMETERS']]], } ], - '__unnamed_17da' : [ 0x10, { + '__unnamed_17d6' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'Parameters' : [ 0xc, ['pointer', ['_MAILSLOT_CREATE_PARAMETERS']]], } ], - '__unnamed_17dc' : [ 0x10, { + '__unnamed_17d8' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'Key' : [ 0x4, ['unsigned long']], 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], } ], - '__unnamed_17e1' : [ 0x10, { + '__unnamed_17dd' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'FileName' : [ 0x4, ['pointer', ['_STRING']]], 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileMaximumInformation'})]], 'FileIndex' : [ 0xc, ['unsigned long']], } ], - '__unnamed_17e3' : [ 0x8, { + '__unnamed_17df' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'CompletionFilter' : [ 0x4, ['unsigned long']], } ], - '__unnamed_17e5' : [ 0x8, { + '__unnamed_17e1' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileMaximumInformation'})]], } ], - '__unnamed_17e7' : [ 0x10, { + '__unnamed_17e3' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileMaximumInformation'})]], 'FileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], @@ -4218,207 +4218,207 @@ nt_types = { 'ClusterCount' : [ 0xc, ['unsigned long']], 'DeleteHandle' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_17e9' : [ 0x10, { + '__unnamed_17e5' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'EaList' : [ 0x4, ['pointer', ['void']]], 'EaListLength' : [ 0x8, ['unsigned long']], 'EaIndex' : [ 0xc, ['unsigned long']], } ], - '__unnamed_17eb' : [ 0x4, { + '__unnamed_17e7' : [ 0x4, { 'Length' : [ 0x0, ['unsigned long']], } ], - '__unnamed_17ef' : [ 0x8, { + '__unnamed_17eb' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'FsInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsMaximumInformation'})]], } ], - '__unnamed_17f1' : [ 0x10, { + '__unnamed_17ed' : [ 0x10, { 'OutputBufferLength' : [ 0x0, ['unsigned long']], 'InputBufferLength' : [ 0x4, ['unsigned long']], 'FsControlCode' : [ 0x8, ['unsigned long']], 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_17f3' : [ 0x10, { + '__unnamed_17ef' : [ 0x10, { 'Length' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], 'Key' : [ 0x4, ['unsigned long']], 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], } ], - '__unnamed_17f5' : [ 0x10, { + '__unnamed_17f1' : [ 0x10, { 'OutputBufferLength' : [ 0x0, ['unsigned long']], 'InputBufferLength' : [ 0x4, ['unsigned long']], 'IoControlCode' : [ 0x8, ['unsigned long']], 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_17f7' : [ 0x8, { + '__unnamed_17f3' : [ 0x8, { 'SecurityInformation' : [ 0x0, ['unsigned long']], 'Length' : [ 0x4, ['unsigned long']], } ], - '__unnamed_17f9' : [ 0x8, { + '__unnamed_17f5' : [ 0x8, { 'SecurityInformation' : [ 0x0, ['unsigned long']], 'SecurityDescriptor' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_17fb' : [ 0x8, { + '__unnamed_17f7' : [ 0x8, { 'Vpb' : [ 0x0, ['pointer', ['_VPB']]], 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], } ], - '__unnamed_17ff' : [ 0x4, { + '__unnamed_17fb' : [ 0x4, { 'Srb' : [ 0x0, ['pointer', ['_SCSI_REQUEST_BLOCK']]], } ], - '__unnamed_1803' : [ 0x10, { + '__unnamed_17ff' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'StartSid' : [ 0x4, ['pointer', ['void']]], 'SidList' : [ 0x8, ['pointer', ['_FILE_GET_QUOTA_INFORMATION']]], 'SidListLength' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1807' : [ 0x4, { + '__unnamed_1803' : [ 0x4, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations'})]], } ], - '__unnamed_1809' : [ 0x10, { + '__unnamed_1805' : [ 0x10, { 'InterfaceType' : [ 0x0, ['pointer', ['_GUID']]], 'Size' : [ 0x4, ['unsigned short']], 'Version' : [ 0x6, ['unsigned short']], 'Interface' : [ 0x8, ['pointer', ['_INTERFACE']]], 'InterfaceSpecificData' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_180d' : [ 0x4, { + '__unnamed_1809' : [ 0x4, { 'Capabilities' : [ 0x0, ['pointer', ['_DEVICE_CAPABILITIES']]], } ], - '__unnamed_180f' : [ 0x4, { + '__unnamed_180b' : [ 0x4, { 'IoResourceRequirementList' : [ 0x0, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], } ], - '__unnamed_1811' : [ 0x10, { + '__unnamed_180d' : [ 0x10, { 'WhichSpace' : [ 0x0, ['unsigned long']], 'Buffer' : [ 0x4, ['pointer', ['void']]], 'Offset' : [ 0x8, ['unsigned long']], 'Length' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1813' : [ 0x1, { + '__unnamed_180f' : [ 0x1, { 'Lock' : [ 0x0, ['unsigned char']], } ], - '__unnamed_1817' : [ 0x4, { + '__unnamed_1813' : [ 0x4, { 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber'})]], } ], - '__unnamed_181b' : [ 0x8, { + '__unnamed_1817' : [ 0x8, { 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], 'LocaleId' : [ 0x4, ['unsigned long']], } ], - '__unnamed_181f' : [ 0x8, { + '__unnamed_181b' : [ 0x8, { 'InPath' : [ 0x0, ['unsigned char']], 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile'})]], } ], - '__unnamed_1821' : [ 0x4, { + '__unnamed_181d' : [ 0x4, { 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], } ], - '__unnamed_1825' : [ 0x4, { + '__unnamed_1821' : [ 0x4, { 'PowerSequence' : [ 0x0, ['pointer', ['_POWER_SEQUENCE']]], } ], - '__unnamed_1829' : [ 0x10, { + '__unnamed_1825' : [ 0x10, { 'SystemContext' : [ 0x0, ['unsigned long']], 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], 'State' : [ 0x8, ['_POWER_STATE']], 'ShutdownType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], } ], - '__unnamed_182b' : [ 0x8, { + '__unnamed_1827' : [ 0x8, { 'AllocatedResources' : [ 0x0, ['pointer', ['_CM_RESOURCE_LIST']]], 'AllocatedResourcesTranslated' : [ 0x4, ['pointer', ['_CM_RESOURCE_LIST']]], } ], - '__unnamed_182d' : [ 0x10, { + '__unnamed_1829' : [ 0x10, { 'ProviderId' : [ 0x0, ['unsigned long']], 'DataPath' : [ 0x4, ['pointer', ['void']]], 'BufferSize' : [ 0x8, ['unsigned long']], 'Buffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_182f' : [ 0x10, { + '__unnamed_182b' : [ 0x10, { 'Argument1' : [ 0x0, ['pointer', ['void']]], 'Argument2' : [ 0x4, ['pointer', ['void']]], 'Argument3' : [ 0x8, ['pointer', ['void']]], 'Argument4' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1831' : [ 0x10, { - 'Create' : [ 0x0, ['__unnamed_17d2']], - 'CreatePipe' : [ 0x0, ['__unnamed_17d6']], - 'CreateMailslot' : [ 0x0, ['__unnamed_17da']], - 'Read' : [ 0x0, ['__unnamed_17dc']], - 'Write' : [ 0x0, ['__unnamed_17dc']], - 'QueryDirectory' : [ 0x0, ['__unnamed_17e1']], - 'NotifyDirectory' : [ 0x0, ['__unnamed_17e3']], - 'QueryFile' : [ 0x0, ['__unnamed_17e5']], - 'SetFile' : [ 0x0, ['__unnamed_17e7']], - 'QueryEa' : [ 0x0, ['__unnamed_17e9']], - 'SetEa' : [ 0x0, ['__unnamed_17eb']], - 'QueryVolume' : [ 0x0, ['__unnamed_17ef']], - 'SetVolume' : [ 0x0, ['__unnamed_17ef']], - 'FileSystemControl' : [ 0x0, ['__unnamed_17f1']], - 'LockControl' : [ 0x0, ['__unnamed_17f3']], - 'DeviceIoControl' : [ 0x0, ['__unnamed_17f5']], - 'QuerySecurity' : [ 0x0, ['__unnamed_17f7']], - 'SetSecurity' : [ 0x0, ['__unnamed_17f9']], - 'MountVolume' : [ 0x0, ['__unnamed_17fb']], - 'VerifyVolume' : [ 0x0, ['__unnamed_17fb']], - 'Scsi' : [ 0x0, ['__unnamed_17ff']], - 'QueryQuota' : [ 0x0, ['__unnamed_1803']], - 'SetQuota' : [ 0x0, ['__unnamed_17eb']], - 'QueryDeviceRelations' : [ 0x0, ['__unnamed_1807']], - 'QueryInterface' : [ 0x0, ['__unnamed_1809']], - 'DeviceCapabilities' : [ 0x0, ['__unnamed_180d']], - 'FilterResourceRequirements' : [ 0x0, ['__unnamed_180f']], - 'ReadWriteConfig' : [ 0x0, ['__unnamed_1811']], - 'SetLock' : [ 0x0, ['__unnamed_1813']], - 'QueryId' : [ 0x0, ['__unnamed_1817']], - 'QueryDeviceText' : [ 0x0, ['__unnamed_181b']], - 'UsageNotification' : [ 0x0, ['__unnamed_181f']], - 'WaitWake' : [ 0x0, ['__unnamed_1821']], - 'PowerSequence' : [ 0x0, ['__unnamed_1825']], - 'Power' : [ 0x0, ['__unnamed_1829']], - 'StartDevice' : [ 0x0, ['__unnamed_182b']], - 'WMI' : [ 0x0, ['__unnamed_182d']], - 'Others' : [ 0x0, ['__unnamed_182f']], + '__unnamed_182d' : [ 0x10, { + 'Create' : [ 0x0, ['__unnamed_17ce']], + 'CreatePipe' : [ 0x0, ['__unnamed_17d2']], + 'CreateMailslot' : [ 0x0, ['__unnamed_17d6']], + 'Read' : [ 0x0, ['__unnamed_17d8']], + 'Write' : [ 0x0, ['__unnamed_17d8']], + 'QueryDirectory' : [ 0x0, ['__unnamed_17dd']], + 'NotifyDirectory' : [ 0x0, ['__unnamed_17df']], + 'QueryFile' : [ 0x0, ['__unnamed_17e1']], + 'SetFile' : [ 0x0, ['__unnamed_17e3']], + 'QueryEa' : [ 0x0, ['__unnamed_17e5']], + 'SetEa' : [ 0x0, ['__unnamed_17e7']], + 'QueryVolume' : [ 0x0, ['__unnamed_17eb']], + 'SetVolume' : [ 0x0, ['__unnamed_17eb']], + 'FileSystemControl' : [ 0x0, ['__unnamed_17ed']], + 'LockControl' : [ 0x0, ['__unnamed_17ef']], + 'DeviceIoControl' : [ 0x0, ['__unnamed_17f1']], + 'QuerySecurity' : [ 0x0, ['__unnamed_17f3']], + 'SetSecurity' : [ 0x0, ['__unnamed_17f5']], + 'MountVolume' : [ 0x0, ['__unnamed_17f7']], + 'VerifyVolume' : [ 0x0, ['__unnamed_17f7']], + 'Scsi' : [ 0x0, ['__unnamed_17fb']], + 'QueryQuota' : [ 0x0, ['__unnamed_17ff']], + 'SetQuota' : [ 0x0, ['__unnamed_17e7']], + 'QueryDeviceRelations' : [ 0x0, ['__unnamed_1803']], + 'QueryInterface' : [ 0x0, ['__unnamed_1805']], + 'DeviceCapabilities' : [ 0x0, ['__unnamed_1809']], + 'FilterResourceRequirements' : [ 0x0, ['__unnamed_180b']], + 'ReadWriteConfig' : [ 0x0, ['__unnamed_180d']], + 'SetLock' : [ 0x0, ['__unnamed_180f']], + 'QueryId' : [ 0x0, ['__unnamed_1813']], + 'QueryDeviceText' : [ 0x0, ['__unnamed_1817']], + 'UsageNotification' : [ 0x0, ['__unnamed_181b']], + 'WaitWake' : [ 0x0, ['__unnamed_181d']], + 'PowerSequence' : [ 0x0, ['__unnamed_1821']], + 'Power' : [ 0x0, ['__unnamed_1825']], + 'StartDevice' : [ 0x0, ['__unnamed_1827']], + 'WMI' : [ 0x0, ['__unnamed_1829']], + 'Others' : [ 0x0, ['__unnamed_182b']], } ], '_IO_STACK_LOCATION' : [ 0x24, { 'MajorFunction' : [ 0x0, ['unsigned char']], 'MinorFunction' : [ 0x1, ['unsigned char']], 'Flags' : [ 0x2, ['unsigned char']], 'Control' : [ 0x3, ['unsigned char']], - 'Parameters' : [ 0x4, ['__unnamed_1831']], + 'Parameters' : [ 0x4, ['__unnamed_182d']], 'DeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], 'FileObject' : [ 0x18, ['pointer', ['_FILE_OBJECT']]], 'CompletionRoutine' : [ 0x1c, ['pointer', ['void']]], 'Context' : [ 0x20, ['pointer', ['void']]], } ], - '__unnamed_1838' : [ 0x18, { + '__unnamed_1834' : [ 0x18, { 'Length' : [ 0x0, ['unsigned long']], 'Alignment' : [ 0x4, ['unsigned long']], 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], } ], - '__unnamed_183a' : [ 0x8, { + '__unnamed_1836' : [ 0x8, { 'MinimumVector' : [ 0x0, ['unsigned long']], 'MaximumVector' : [ 0x4, ['unsigned long']], } ], - '__unnamed_183c' : [ 0x8, { + '__unnamed_1838' : [ 0x8, { 'MinimumChannel' : [ 0x0, ['unsigned long']], 'MaximumChannel' : [ 0x4, ['unsigned long']], } ], - '__unnamed_183e' : [ 0x10, { + '__unnamed_183a' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'MinBusNumber' : [ 0x4, ['unsigned long']], 'MaxBusNumber' : [ 0x8, ['unsigned long']], 'Reserved' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1840' : [ 0xc, { + '__unnamed_183c' : [ 0xc, { 'Priority' : [ 0x0, ['unsigned long']], 'Reserved1' : [ 0x4, ['unsigned long']], 'Reserved2' : [ 0x8, ['unsigned long']], } ], - '__unnamed_1842' : [ 0x18, { - 'Port' : [ 0x0, ['__unnamed_1838']], - 'Memory' : [ 0x0, ['__unnamed_1838']], - 'Interrupt' : [ 0x0, ['__unnamed_183a']], - 'Dma' : [ 0x0, ['__unnamed_183c']], - 'Generic' : [ 0x0, ['__unnamed_1838']], - 'DevicePrivate' : [ 0x0, ['__unnamed_1517']], - 'BusNumber' : [ 0x0, ['__unnamed_183e']], - 'ConfigData' : [ 0x0, ['__unnamed_1840']], + '__unnamed_183e' : [ 0x18, { + 'Port' : [ 0x0, ['__unnamed_1834']], + 'Memory' : [ 0x0, ['__unnamed_1834']], + 'Interrupt' : [ 0x0, ['__unnamed_1836']], + 'Dma' : [ 0x0, ['__unnamed_1838']], + 'Generic' : [ 0x0, ['__unnamed_1834']], + 'DevicePrivate' : [ 0x0, ['__unnamed_1512']], + 'BusNumber' : [ 0x0, ['__unnamed_183a']], + 'ConfigData' : [ 0x0, ['__unnamed_183c']], } ], '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { 'Option' : [ 0x0, ['unsigned char']], @@ -4427,7 +4427,7 @@ nt_types = { 'Spare1' : [ 0x3, ['unsigned char']], 'Flags' : [ 0x4, ['unsigned short']], 'Spare2' : [ 0x6, ['unsigned short']], - 'u' : [ 0x8, ['__unnamed_1842']], + 'u' : [ 0x8, ['__unnamed_183e']], } ], '_LUID_AND_ATTRIBUTES' : [ 0xc, { 'Luid' : [ 0x0, ['_LUID']], @@ -4446,25 +4446,25 @@ nt_types = { 'CallerAddress' : [ 0x14, ['array', 10, ['pointer', ['void']]]], 'KeyBodyList' : [ 0x3c, ['_LIST_ENTRY']], } ], - '__unnamed_1853' : [ 0x4, { + '__unnamed_184f' : [ 0x4, { 'DataLength' : [ 0x0, ['short']], 'TotalLength' : [ 0x2, ['short']], } ], - '__unnamed_1855' : [ 0x4, { - 's1' : [ 0x0, ['__unnamed_1853']], + '__unnamed_1851' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_184f']], 'Length' : [ 0x0, ['unsigned long']], } ], - '__unnamed_1857' : [ 0x4, { + '__unnamed_1853' : [ 0x4, { 'Type' : [ 0x0, ['short']], 'DataInfoOffset' : [ 0x2, ['short']], } ], - '__unnamed_1859' : [ 0x4, { - 's2' : [ 0x0, ['__unnamed_1857']], + '__unnamed_1855' : [ 0x4, { + 's2' : [ 0x0, ['__unnamed_1853']], 'ZeroInit' : [ 0x0, ['unsigned long']], } ], '_PORT_MESSAGE' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_1855']], - 'u2' : [ 0x4, ['__unnamed_1859']], + 'u1' : [ 0x0, ['__unnamed_1851']], + 'u2' : [ 0x4, ['__unnamed_1855']], 'ClientId' : [ 0x8, ['_CLIENT_ID']], 'DoNotUseThisField' : [ 0x8, ['double']], 'MessageId' : [ 0x10, ['unsigned long']], @@ -4619,17 +4619,17 @@ nt_types = { 'Parameter3' : [ 0xc, ['unsigned long']], 'Parameter4' : [ 0x10, ['unsigned long']], } ], - '__unnamed_1898' : [ 0x4, { - 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32)]], + '__unnamed_1894' : [ 0x4, { + 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], } ], - '__unnamed_189a' : [ 0x4, { - 'bits' : [ 0x0, ['__unnamed_1898']], + '__unnamed_1896' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_1894']], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_PCI_SLOT_NUMBER' : [ 0x4, { - 'u' : [ 0x0, ['__unnamed_189a']], + 'u' : [ 0x0, ['__unnamed_1896']], } ], '_Wx86ThreadState' : [ 0xc, { 'CallBx86Eip' : [ 0x0, ['pointer', ['unsigned long']]], @@ -4650,9 +4650,9 @@ nt_types = { 'PostList' : [ 0x8, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x10, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x14, ['pointer', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_SID' : [ 0xc, { @@ -4666,19 +4666,19 @@ nt_types = { 'NextFree' : [ 0x0, ['pointer', ['_RTL_HANDLE_TABLE_ENTRY']]], } ], '_MMPTE_HARDWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Writable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_INTERFACE' : [ 0x10, { 'Size' : [ 0x0, ['unsigned short']], @@ -4713,46 +4713,46 @@ nt_types = { 'Dacl' : [ 0x10, ['unsigned long']], } ], '_PM_SUPPORT' : [ 0x1, { - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], - '__unnamed_18c1' : [ 0xc, { + '__unnamed_18be' : [ 0xc, { 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], 'AllocateFromCount' : [ 0x4, ['unsigned long']], 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], } ], - '__unnamed_18c3' : [ 0x4, { + '__unnamed_18c0' : [ 0x4, { 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], } ], - '__unnamed_18c7' : [ 0x4, { + '__unnamed_18c4' : [ 0x4, { 'AllocatedResources' : [ 0x0, ['pointer', ['pointer', ['_CM_PARTIAL_RESOURCE_LIST']]]], } ], - '__unnamed_18c9' : [ 0x10, { + '__unnamed_18c6' : [ 0x10, { 'PhysicalDeviceObject' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], 'ConflictingResource' : [ 0x4, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], 'ConflictCount' : [ 0x8, ['pointer', ['unsigned long']]], 'Conflicts' : [ 0xc, ['pointer', ['pointer', ['_ARBITER_CONFLICT_INFO']]]], } ], - '__unnamed_18cb' : [ 0x4, { + '__unnamed_18c8' : [ 0x4, { 'ReserveDevice' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], } ], - '__unnamed_18cd' : [ 0x10, { - 'TestAllocation' : [ 0x0, ['__unnamed_18c1']], - 'RetestAllocation' : [ 0x0, ['__unnamed_18c1']], - 'BootAllocation' : [ 0x0, ['__unnamed_18c3']], - 'QueryAllocatedResources' : [ 0x0, ['__unnamed_18c7']], - 'QueryConflict' : [ 0x0, ['__unnamed_18c9']], - 'QueryArbitrate' : [ 0x0, ['__unnamed_18c3']], - 'AddReserved' : [ 0x0, ['__unnamed_18cb']], + '__unnamed_18ca' : [ 0x10, { + 'TestAllocation' : [ 0x0, ['__unnamed_18be']], + 'RetestAllocation' : [ 0x0, ['__unnamed_18be']], + 'BootAllocation' : [ 0x0, ['__unnamed_18c0']], + 'QueryAllocatedResources' : [ 0x0, ['__unnamed_18c4']], + 'QueryConflict' : [ 0x0, ['__unnamed_18c6']], + 'QueryArbitrate' : [ 0x0, ['__unnamed_18c0']], + 'AddReserved' : [ 0x0, ['__unnamed_18c8']], } ], '_ARBITER_PARAMETERS' : [ 0x10, { - 'Parameters' : [ 0x0, ['__unnamed_18cd']], + 'Parameters' : [ 0x0, ['__unnamed_18ca']], } ], '_SECURITY_TOKEN_AUDIT_DATA' : [ 0xc, { 'Length' : [ 0x0, ['unsigned long']], @@ -4772,18 +4772,18 @@ nt_types = { 'Size' : [ 0x4, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x4, { - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 7)]], - 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11)]], - 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'LockCharged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned long')]], + 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11, native_type='unsigned long')]], + 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'LockCharged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], } ], '_MI_VERIFIER_DRIVER_ENTRY' : [ 0x60, { 'Links' : [ 0x0, ['_LIST_ENTRY']], @@ -4873,25 +4873,25 @@ nt_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -4925,43 +4925,43 @@ nt_types = { 'PolicyOverlay' : [ 0x0, ['_SEP_AUDIT_POLICY_OVERLAY']], 'Overlay' : [ 0x0, ['unsigned long long']], } ], - '__unnamed_1901' : [ 0x14, { + '__unnamed_18fe' : [ 0x14, { 'ClassGuid' : [ 0x0, ['_GUID']], 'SymbolicLinkName' : [ 0x10, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1903' : [ 0x2, { + '__unnamed_1900' : [ 0x2, { 'DeviceIds' : [ 0x0, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1905' : [ 0x2, { + '__unnamed_1902' : [ 0x2, { 'DeviceId' : [ 0x0, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1907' : [ 0x8, { + '__unnamed_1904' : [ 0x8, { 'NotificationStructure' : [ 0x0, ['pointer', ['void']]], 'DeviceIds' : [ 0x4, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1909' : [ 0x4, { + '__unnamed_1906' : [ 0x4, { 'Notification' : [ 0x0, ['pointer', ['void']]], } ], - '__unnamed_190b' : [ 0x8, { + '__unnamed_1908' : [ 0x8, { 'NotificationCode' : [ 0x0, ['unsigned long']], 'NotificationData' : [ 0x4, ['unsigned long']], } ], - '__unnamed_190d' : [ 0x8, { + '__unnamed_190a' : [ 0x8, { 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['unsigned short']]], } ], - '__unnamed_190f' : [ 0x10, { + '__unnamed_190c' : [ 0x10, { 'BlockedDriverGuid' : [ 0x0, ['_GUID']], } ], - '__unnamed_1911' : [ 0x14, { - 'DeviceClass' : [ 0x0, ['__unnamed_1901']], - 'TargetDevice' : [ 0x0, ['__unnamed_1903']], - 'InstallDevice' : [ 0x0, ['__unnamed_1905']], - 'CustomNotification' : [ 0x0, ['__unnamed_1907']], - 'ProfileNotification' : [ 0x0, ['__unnamed_1909']], - 'PowerNotification' : [ 0x0, ['__unnamed_190b']], - 'VetoNotification' : [ 0x0, ['__unnamed_190d']], - 'BlockedDriverNotification' : [ 0x0, ['__unnamed_190f']], + '__unnamed_190e' : [ 0x14, { + 'DeviceClass' : [ 0x0, ['__unnamed_18fe']], + 'TargetDevice' : [ 0x0, ['__unnamed_1900']], + 'InstallDevice' : [ 0x0, ['__unnamed_1902']], + 'CustomNotification' : [ 0x0, ['__unnamed_1904']], + 'ProfileNotification' : [ 0x0, ['__unnamed_1906']], + 'PowerNotification' : [ 0x0, ['__unnamed_1908']], + 'VetoNotification' : [ 0x0, ['__unnamed_190a']], + 'BlockedDriverNotification' : [ 0x0, ['__unnamed_190c']], } ], '_PLUGPLAY_EVENT_BLOCK' : [ 0x38, { 'EventGuid' : [ 0x0, ['_GUID']], @@ -4970,39 +4970,39 @@ nt_types = { 'Flags' : [ 0x18, ['unsigned long']], 'TotalSize' : [ 0x1c, ['unsigned long']], 'DeviceObject' : [ 0x20, ['pointer', ['void']]], - 'u' : [ 0x24, ['__unnamed_1911']], + 'u' : [ 0x24, ['__unnamed_190e']], } ], '_CACHED_CHILD_LIST' : [ 0x8, { 'Count' : [ 0x0, ['unsigned long']], 'ValueList' : [ 0x4, ['unsigned long']], 'RealKcb' : [ 0x4, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], } ], - '__unnamed_1917' : [ 0x10, { + '__unnamed_1914' : [ 0x10, { 'PageNo' : [ 0x0, ['unsigned long']], 'StartPage' : [ 0x4, ['unsigned long']], 'EndPage' : [ 0x8, ['unsigned long']], 'CheckSum' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1919' : [ 0x10, { + '__unnamed_1916' : [ 0x10, { 'Next' : [ 0x0, ['pointer', ['_PO_MEMORY_RANGE_ARRAY']]], 'NextTable' : [ 0x4, ['unsigned long']], 'CheckSum' : [ 0x8, ['unsigned long']], 'EntryCount' : [ 0xc, ['unsigned long']], } ], '_PO_MEMORY_RANGE_ARRAY' : [ 0x10, { - 'Range' : [ 0x0, ['__unnamed_1917']], - 'Link' : [ 0x0, ['__unnamed_1919']], + 'Range' : [ 0x0, ['__unnamed_1914']], + 'Link' : [ 0x0, ['__unnamed_1916']], } ], - '__unnamed_192b' : [ 0x8, { + '__unnamed_1928' : [ 0x8, { 'Signature' : [ 0x0, ['unsigned long']], 'CheckSum' : [ 0x4, ['unsigned long']], } ], - '__unnamed_192d' : [ 0x10, { + '__unnamed_192a' : [ 0x10, { 'DiskId' : [ 0x0, ['_GUID']], } ], - '__unnamed_192f' : [ 0x10, { - 'Mbr' : [ 0x0, ['__unnamed_192b']], - 'Gpt' : [ 0x0, ['__unnamed_192d']], + '__unnamed_192c' : [ 0x10, { + 'Mbr' : [ 0x0, ['__unnamed_1928']], + 'Gpt' : [ 0x0, ['__unnamed_192a']], } ], '_DUMP_INITIALIZATION_CONTEXT' : [ 0x70, { 'Length' : [ 0x0, ['unsigned long']], @@ -5023,20 +5023,20 @@ nt_types = { 'TargetAddress' : [ 0x50, ['pointer', ['void']]], 'WritePendingRoutine' : [ 0x54, ['pointer', ['void']]], 'PartitionStyle' : [ 0x58, ['unsigned long']], - 'DiskInfo' : [ 0x5c, ['__unnamed_192f']], + 'DiskInfo' : [ 0x5c, ['__unnamed_192c']], } ], '_IO_CLIENT_EXTENSION' : [ 0x8, { 'NextExtension' : [ 0x0, ['pointer', ['_IO_CLIENT_EXTENSION']]], 'ClientIdentificationAddress' : [ 0x4, ['pointer', ['void']]], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], } ], '_CM_NAME_HASH' : [ 0xc, { 'ConvKey' : [ 0x0, ['unsigned long']], @@ -5059,8 +5059,8 @@ nt_types = { 'WorkSpace' : [ 0x34, ['unsigned long']], } ], '_SEP_AUDIT_POLICY_OVERLAY' : [ 0x8, { - 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36)]], - 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37)]], + 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], } ], '_PCI_HEADER_TYPE_0' : [ 0x30, { 'BaseAddresses' : [ 0x0, ['array', 6, ['unsigned long']]], @@ -5134,7 +5134,7 @@ nt_types = { 'ReadyS0' : [ 0x38, ['_LIST_ENTRY']], 'WaitS0' : [ 0x40, ['_LIST_ENTRY']], } ], - '__unnamed_1964' : [ 0x8, { + '__unnamed_1961' : [ 0x8, { 'Base' : [ 0x0, ['unsigned long']], 'Limit' : [ 0x4, ['unsigned long']], } ], @@ -5147,21 +5147,21 @@ nt_types = { 'SecondaryBus' : [ 0x9, ['unsigned char']], 'SubordinateBus' : [ 0xa, ['unsigned char']], 'SecondaryLatency' : [ 0xb, ['unsigned char']], - 'Range' : [ 0xc, ['array', 4, ['__unnamed_1964']]], + 'Range' : [ 0xc, ['array', 4, ['__unnamed_1961']]], 'InterruptLine' : [ 0x2c, ['unsigned char']], 'InterruptPin' : [ 0x2d, ['unsigned char']], 'BridgeControl' : [ 0x2e, ['unsigned short']], } ], '_SEP_AUDIT_POLICY_CATEGORIES' : [ 0x8, { - 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28)]], - 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], - 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28, native_type='unsigned long')]], + 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], + 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], } ], '_CM_KEY_VALUE' : [ 0x18, { 'Signature' : [ 0x0, ['unsigned short']], @@ -5369,18 +5369,18 @@ nt_types = { 'ModifiedId' : [ 0x10, ['_LUID']], 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], } ], - '__unnamed_19ae' : [ 0x8, { + '__unnamed_19ab' : [ 0x8, { 'EndingOffset' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], 'ResourceToRelease' : [ 0x4, ['pointer', ['pointer', ['_ERESOURCE']]]], } ], - '__unnamed_19b0' : [ 0x4, { + '__unnamed_19ad' : [ 0x4, { 'ResourceToRelease' : [ 0x0, ['pointer', ['_ERESOURCE']]], } ], - '__unnamed_19b4' : [ 0x8, { + '__unnamed_19b1' : [ 0x8, { 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], 'PageProtection' : [ 0x4, ['unsigned long']], } ], - '__unnamed_19b6' : [ 0x14, { + '__unnamed_19b3' : [ 0x14, { 'Argument1' : [ 0x0, ['pointer', ['void']]], 'Argument2' : [ 0x4, ['pointer', ['void']]], 'Argument3' : [ 0x8, ['pointer', ['void']]], @@ -5388,10 +5388,10 @@ nt_types = { 'Argument5' : [ 0x10, ['pointer', ['void']]], } ], '_FS_FILTER_PARAMETERS' : [ 0x14, { - 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_19ae']], - 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_19b0']], - 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_19b4']], - 'Others' : [ 0x0, ['__unnamed_19b6']], + 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_19ab']], + 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_19ad']], + 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_19b1']], + 'Others' : [ 0x0, ['__unnamed_19b3']], } ], '_DESCRIPTOR' : [ 0x8, { 'Pad' : [ 0x0, ['unsigned short']], @@ -5416,707 +5416,5 @@ nt_types = { 'ReferenceCount' : [ 0xc, ['unsigned long']], 'DescriptorLength' : [ 0x10, ['unsigned long']], 'Descriptor' : [ 0x14, ['_SECURITY_DESCRIPTOR_RELATIVE']], -} ], - '_KAPC' : [ 0x30, { - 'Type' : [ 0x0, ['short']], - 'Size' : [ 0x2, ['short']], - 'Spare0' : [ 0x4, ['unsigned long']], - 'Thread' : [ 0x8, ['pointer', ['_KTHREAD']]], - 'ApcListEntry' : [ 0xc, ['_LIST_ENTRY']], - 'KernelRoutine' : [ 0x14, ['pointer', ['void']]], - 'RundownRoutine' : [ 0x18, ['pointer', ['void']]], - 'NormalRoutine' : [ 0x1c, ['pointer', ['void']]], - 'NormalContext' : [ 0x20, ['pointer', ['void']]], - 'SystemArgument1' : [ 0x24, ['pointer', ['void']]], - 'SystemArgument2' : [ 0x28, ['pointer', ['void']]], - 'ApcStateIndex' : [ 0x2c, ['unsigned char']], - 'ApcMode' : [ 0x2d, ['unsigned char']], - 'Inserted' : [ 0x2e, ['unsigned char']], -} ], - '_GENERAL_LOOKASIDE' : [ 0x80, { - 'ListHead' : [ 0x0, ['_SLIST_HEADER']], - 'Depth' : [ 0x8, ['unsigned short']], - 'MaximumDepth' : [ 0xa, ['unsigned short']], - 'TotalAllocates' : [ 0xc, ['unsigned long']], - 'AllocateMisses' : [ 0x10, ['unsigned long']], - 'AllocateHits' : [ 0x10, ['unsigned long']], - 'TotalFrees' : [ 0x14, ['unsigned long']], - 'FreeMisses' : [ 0x18, ['unsigned long']], - 'FreeHits' : [ 0x18, ['unsigned long']], - 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], - 'Tag' : [ 0x20, ['unsigned long']], - 'Size' : [ 0x24, ['unsigned long']], - 'Allocate' : [ 0x28, ['pointer', ['void']]], - 'Free' : [ 0x2c, ['pointer', ['void']]], - 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], - 'LastTotalAllocates' : [ 0x38, ['unsigned long']], - 'LastAllocateMisses' : [ 0x3c, ['unsigned long']], - 'LastAllocateHits' : [ 0x3c, ['unsigned long']], - 'Future' : [ 0x40, ['array', 2, ['unsigned long']]], -} ], - '_KPRCB' : [ 0xc50, { - 'MinorVersion' : [ 0x0, ['unsigned short']], - 'MajorVersion' : [ 0x2, ['unsigned short']], - 'CurrentThread' : [ 0x4, ['pointer', ['_KTHREAD']]], - 'NextThread' : [ 0x8, ['pointer', ['_KTHREAD']]], - 'IdleThread' : [ 0xc, ['pointer', ['_KTHREAD']]], - 'Number' : [ 0x10, ['unsigned char']], - 'Reserved' : [ 0x11, ['unsigned char']], - 'BuildType' : [ 0x12, ['unsigned short']], - 'SetMember' : [ 0x14, ['unsigned long']], - 'CpuType' : [ 0x18, ['unsigned char']], - 'CpuID' : [ 0x19, ['unsigned char']], - 'CpuStep' : [ 0x1a, ['unsigned short']], - 'ProcessorState' : [ 0x1c, ['_KPROCESSOR_STATE']], - 'KernelReserved' : [ 0x33c, ['array', 16, ['unsigned long']]], - 'HalReserved' : [ 0x37c, ['array', 16, ['unsigned long']]], - 'PrcbPad0' : [ 0x3bc, ['array', 92, ['unsigned char']]], - 'LockQueue' : [ 0x418, ['array', 16, ['_KSPIN_LOCK_QUEUE']]], - 'PrcbPad1' : [ 0x498, ['array', 8, ['unsigned char']]], - 'NpxThread' : [ 0x4a0, ['pointer', ['_KTHREAD']]], - 'InterruptCount' : [ 0x4a4, ['unsigned long']], - 'KernelTime' : [ 0x4a8, ['unsigned long']], - 'UserTime' : [ 0x4ac, ['unsigned long']], - 'DpcTime' : [ 0x4b0, ['unsigned long']], - 'DebugDpcTime' : [ 0x4b4, ['unsigned long']], - 'InterruptTime' : [ 0x4b8, ['unsigned long']], - 'AdjustDpcThreshold' : [ 0x4bc, ['unsigned long']], - 'PageColor' : [ 0x4c0, ['unsigned long']], - 'SkipTick' : [ 0x4c4, ['unsigned long']], - 'MultiThreadSetBusy' : [ 0x4c8, ['unsigned char']], - 'Spare2' : [ 0x4c9, ['array', 3, ['unsigned char']]], - 'ParentNode' : [ 0x4cc, ['pointer', ['_KNODE']]], - 'MultiThreadProcessorSet' : [ 0x4d0, ['unsigned long']], - 'MultiThreadSetMaster' : [ 0x4d4, ['pointer', ['_KPRCB']]], - 'ThreadStartCount' : [ 0x4d8, ['array', 2, ['unsigned long']]], - 'CcFastReadNoWait' : [ 0x4e0, ['unsigned long']], - 'CcFastReadWait' : [ 0x4e4, ['unsigned long']], - 'CcFastReadNotPossible' : [ 0x4e8, ['unsigned long']], - 'CcCopyReadNoWait' : [ 0x4ec, ['unsigned long']], - 'CcCopyReadWait' : [ 0x4f0, ['unsigned long']], - 'CcCopyReadNoWaitMiss' : [ 0x4f4, ['unsigned long']], - 'KeAlignmentFixupCount' : [ 0x4f8, ['unsigned long']], - 'KeContextSwitches' : [ 0x4fc, ['unsigned long']], - 'KeDcacheFlushCount' : [ 0x500, ['unsigned long']], - 'KeExceptionDispatchCount' : [ 0x504, ['unsigned long']], - 'KeFirstLevelTbFills' : [ 0x508, ['unsigned long']], - 'KeFloatingEmulationCount' : [ 0x50c, ['unsigned long']], - 'KeIcacheFlushCount' : [ 0x510, ['unsigned long']], - 'KeSecondLevelTbFills' : [ 0x514, ['unsigned long']], - 'KeSystemCalls' : [ 0x518, ['unsigned long']], - 'SpareCounter0' : [ 0x51c, ['array', 1, ['unsigned long']]], - 'PPLookasideList' : [ 0x520, ['array', 16, ['_PP_LOOKASIDE_LIST']]], - 'PPNPagedLookasideList' : [ 0x5a0, ['array', 32, ['_PP_LOOKASIDE_LIST']]], - 'PPPagedLookasideList' : [ 0x6a0, ['array', 32, ['_PP_LOOKASIDE_LIST']]], - 'PacketBarrier' : [ 0x7a0, ['unsigned long']], - 'ReverseStall' : [ 0x7a4, ['unsigned long']], - 'IpiFrame' : [ 0x7a8, ['pointer', ['void']]], - 'PrcbPad2' : [ 0x7ac, ['array', 52, ['unsigned char']]], - 'CurrentPacket' : [ 0x7e0, ['array', 3, ['pointer', ['void']]]], - 'TargetSet' : [ 0x7ec, ['unsigned long']], - 'WorkerRoutine' : [ 0x7f0, ['pointer', ['void']]], - 'IpiFrozen' : [ 0x7f4, ['unsigned long']], - 'PrcbPad3' : [ 0x7f8, ['array', 40, ['unsigned char']]], - 'RequestSummary' : [ 0x820, ['unsigned long']], - 'SignalDone' : [ 0x824, ['pointer', ['_KPRCB']]], - 'PrcbPad4' : [ 0x828, ['array', 56, ['unsigned char']]], - 'DpcListHead' : [ 0x860, ['_LIST_ENTRY']], - 'DpcStack' : [ 0x868, ['pointer', ['void']]], - 'DpcCount' : [ 0x86c, ['unsigned long']], - 'DpcQueueDepth' : [ 0x870, ['unsigned long']], - 'DpcRoutineActive' : [ 0x874, ['unsigned long']], - 'DpcInterruptRequested' : [ 0x878, ['unsigned long']], - 'DpcLastCount' : [ 0x87c, ['unsigned long']], - 'DpcRequestRate' : [ 0x880, ['unsigned long']], - 'MaximumDpcQueueDepth' : [ 0x884, ['unsigned long']], - 'MinimumDpcRate' : [ 0x888, ['unsigned long']], - 'QuantumEnd' : [ 0x88c, ['unsigned long']], - 'PrcbPad5' : [ 0x890, ['array', 16, ['unsigned char']]], - 'DpcLock' : [ 0x8a0, ['unsigned long']], - 'PrcbPad6' : [ 0x8a4, ['array', 28, ['unsigned char']]], - 'CallDpc' : [ 0x8c0, ['_KDPC']], - 'ChainedInterruptList' : [ 0x8e0, ['pointer', ['void']]], - 'LookasideIrpFloat' : [ 0x8e4, ['long']], - 'SpareFields0' : [ 0x8e8, ['array', 6, ['unsigned long']]], - 'VendorString' : [ 0x900, ['array', 13, ['unsigned char']]], - 'InitialApicId' : [ 0x90d, ['unsigned char']], - 'LogicalProcessorsPerPhysicalProcessor' : [ 0x90e, ['unsigned char']], - 'MHz' : [ 0x910, ['unsigned long']], - 'FeatureBits' : [ 0x914, ['unsigned long']], - 'UpdateSignature' : [ 0x918, ['_LARGE_INTEGER']], - 'NpxSaveArea' : [ 0x920, ['_FX_SAVE_AREA']], - 'PowerState' : [ 0xb30, ['_PROCESSOR_POWER_STATE']], -} ], - '_SHARED_CACHE_MAP' : [ 0x130, { - 'NodeTypeCode' : [ 0x0, ['short']], - 'NodeByteSize' : [ 0x2, ['short']], - 'OpenCount' : [ 0x4, ['unsigned long']], - 'FileSize' : [ 0x8, ['_LARGE_INTEGER']], - 'BcbList' : [ 0x10, ['_LIST_ENTRY']], - 'SectionSize' : [ 0x18, ['_LARGE_INTEGER']], - 'ValidDataLength' : [ 0x20, ['_LARGE_INTEGER']], - 'ValidDataGoal' : [ 0x28, ['_LARGE_INTEGER']], - 'InitialVacbs' : [ 0x30, ['array', 4, ['pointer', ['_VACB']]]], - 'Vacbs' : [ 0x40, ['pointer', ['pointer', ['_VACB']]]], - 'FileObject' : [ 0x44, ['pointer', ['_FILE_OBJECT']]], - 'ActiveVacb' : [ 0x48, ['pointer', ['_VACB']]], - 'NeedToZero' : [ 0x4c, ['pointer', ['void']]], - 'ActivePage' : [ 0x50, ['unsigned long']], - 'NeedToZeroPage' : [ 0x54, ['unsigned long']], - 'ActiveVacbSpinLock' : [ 0x58, ['unsigned long']], - 'VacbActiveCount' : [ 0x5c, ['unsigned long']], - 'DirtyPages' : [ 0x60, ['unsigned long']], - 'SharedCacheMapLinks' : [ 0x64, ['_LIST_ENTRY']], - 'Flags' : [ 0x6c, ['unsigned long']], - 'Status' : [ 0x70, ['long']], - 'Mbcb' : [ 0x74, ['pointer', ['_MBCB']]], - 'Section' : [ 0x78, ['pointer', ['void']]], - 'CreateEvent' : [ 0x7c, ['pointer', ['_KEVENT']]], - 'WaitOnActiveCount' : [ 0x80, ['pointer', ['_KEVENT']]], - 'PagesToWrite' : [ 0x84, ['unsigned long']], - 'BeyondLastFlush' : [ 0x88, ['long long']], - 'Callbacks' : [ 0x90, ['pointer', ['_CACHE_MANAGER_CALLBACKS']]], - 'LazyWriteContext' : [ 0x94, ['pointer', ['void']]], - 'PrivateList' : [ 0x98, ['_LIST_ENTRY']], - 'LogHandle' : [ 0xa0, ['pointer', ['void']]], - 'FlushToLsnRoutine' : [ 0xa4, ['pointer', ['void']]], - 'DirtyPageThreshold' : [ 0xa8, ['unsigned long']], - 'LazyWritePassCount' : [ 0xac, ['unsigned long']], - 'UninitializeEvent' : [ 0xb0, ['pointer', ['_CACHE_UNINITIALIZE_EVENT']]], - 'NeedToZeroVacb' : [ 0xb4, ['pointer', ['_VACB']]], - 'BcbSpinLock' : [ 0xb8, ['unsigned long']], - 'Reserved' : [ 0xbc, ['pointer', ['void']]], - 'Event' : [ 0xc0, ['_KEVENT']], - 'VacbPushLock' : [ 0xd0, ['_EX_PUSH_LOCK']], - 'PrivateCacheMap' : [ 0xd8, ['_PRIVATE_CACHE_MAP']], -} ], - '_DEFERRED_WRITE' : [ 0x28, { - 'NodeTypeCode' : [ 0x0, ['short']], - 'NodeByteSize' : [ 0x2, ['short']], - 'FileObject' : [ 0x4, ['pointer', ['_FILE_OBJECT']]], - 'BytesToWrite' : [ 0x8, ['unsigned long']], - 'DeferredWriteLinks' : [ 0xc, ['_LIST_ENTRY']], - 'Event' : [ 0x14, ['pointer', ['_KEVENT']]], - 'PostRoutine' : [ 0x18, ['pointer', ['void']]], - 'Context1' : [ 0x1c, ['pointer', ['void']]], - 'Context2' : [ 0x20, ['pointer', ['void']]], - 'LimitModifiedPages' : [ 0x24, ['unsigned char']], -} ], - '_PEB' : [ 0x210, { - 'InheritedAddressSpace' : [ 0x0, ['unsigned char']], - 'ReadImageFileExecOptions' : [ 0x1, ['unsigned char']], - 'BeingDebugged' : [ 0x2, ['unsigned char']], - 'SpareBool' : [ 0x3, ['unsigned char']], - 'Mutant' : [ 0x4, ['pointer', ['void']]], - 'ImageBaseAddress' : [ 0x8, ['pointer', ['void']]], - 'Ldr' : [ 0xc, ['pointer', ['_PEB_LDR_DATA']]], - 'ProcessParameters' : [ 0x10, ['pointer', ['_RTL_USER_PROCESS_PARAMETERS']]], - 'SubSystemData' : [ 0x14, ['pointer', ['void']]], - 'ProcessHeap' : [ 0x18, ['pointer', ['void']]], - 'FastPebLock' : [ 0x1c, ['pointer', ['_RTL_CRITICAL_SECTION']]], - 'FastPebLockRoutine' : [ 0x20, ['pointer', ['void']]], - 'FastPebUnlockRoutine' : [ 0x24, ['pointer', ['void']]], - 'EnvironmentUpdateCount' : [ 0x28, ['unsigned long']], - 'KernelCallbackTable' : [ 0x2c, ['pointer', ['void']]], - 'SystemReserved' : [ 0x30, ['array', 1, ['unsigned long']]], - 'AtlThunkSListPtr32' : [ 0x34, ['unsigned long']], - 'FreeList' : [ 0x38, ['pointer', ['_PEB_FREE_BLOCK']]], - 'TlsExpansionCounter' : [ 0x3c, ['unsigned long']], - 'TlsBitmap' : [ 0x40, ['pointer', ['void']]], - 'TlsBitmapBits' : [ 0x44, ['array', 2, ['unsigned long']]], - 'ReadOnlySharedMemoryBase' : [ 0x4c, ['pointer', ['void']]], - 'ReadOnlySharedMemoryHeap' : [ 0x50, ['pointer', ['void']]], - 'ReadOnlyStaticServerData' : [ 0x54, ['pointer', ['pointer', ['void']]]], - 'AnsiCodePageData' : [ 0x58, ['pointer', ['void']]], - 'OemCodePageData' : [ 0x5c, ['pointer', ['void']]], - 'UnicodeCaseTableData' : [ 0x60, ['pointer', ['void']]], - 'NumberOfProcessors' : [ 0x64, ['unsigned long']], - 'NtGlobalFlag' : [ 0x68, ['unsigned long']], - 'CriticalSectionTimeout' : [ 0x70, ['_LARGE_INTEGER']], - 'HeapSegmentReserve' : [ 0x78, ['unsigned long']], - 'HeapSegmentCommit' : [ 0x7c, ['unsigned long']], - 'HeapDeCommitTotalFreeThreshold' : [ 0x80, ['unsigned long']], - 'HeapDeCommitFreeBlockThreshold' : [ 0x84, ['unsigned long']], - 'NumberOfHeaps' : [ 0x88, ['unsigned long']], - 'MaximumNumberOfHeaps' : [ 0x8c, ['unsigned long']], - 'ProcessHeaps' : [ 0x90, ['pointer', ['pointer', ['void']]]], - 'GdiSharedHandleTable' : [ 0x94, ['pointer', ['void']]], - 'ProcessStarterHelper' : [ 0x98, ['pointer', ['void']]], - 'GdiDCAttributeList' : [ 0x9c, ['unsigned long']], - 'LoaderLock' : [ 0xa0, ['pointer', ['void']]], - 'OSMajorVersion' : [ 0xa4, ['unsigned long']], - 'OSMinorVersion' : [ 0xa8, ['unsigned long']], - 'OSBuildNumber' : [ 0xac, ['unsigned short']], - 'OSCSDVersion' : [ 0xae, ['unsigned short']], - 'OSPlatformId' : [ 0xb0, ['unsigned long']], - 'ImageSubsystem' : [ 0xb4, ['unsigned long']], - 'ImageSubsystemMajorVersion' : [ 0xb8, ['unsigned long']], - 'ImageSubsystemMinorVersion' : [ 0xbc, ['unsigned long']], - 'ImageProcessAffinityMask' : [ 0xc0, ['unsigned long']], - 'GdiHandleBuffer' : [ 0xc4, ['array', 34, ['unsigned long']]], - 'PostProcessInitRoutine' : [ 0x14c, ['pointer', ['void']]], - 'TlsExpansionBitmap' : [ 0x150, ['pointer', ['void']]], - 'TlsExpansionBitmapBits' : [ 0x154, ['array', 32, ['unsigned long']]], - 'SessionId' : [ 0x1d4, ['unsigned long']], - 'AppCompatFlags' : [ 0x1d8, ['_ULARGE_INTEGER']], - 'AppCompatFlagsUser' : [ 0x1e0, ['_ULARGE_INTEGER']], - 'pShimData' : [ 0x1e8, ['pointer', ['void']]], - 'AppCompatInfo' : [ 0x1ec, ['pointer', ['void']]], - 'CSDVersion' : [ 0x1f0, ['_UNICODE_STRING']], - 'ActivationContextData' : [ 0x1f8, ['pointer', ['void']]], - 'ProcessAssemblyStorageMap' : [ 0x1fc, ['pointer', ['void']]], - 'SystemDefaultActivationContextData' : [ 0x200, ['pointer', ['void']]], - 'SystemAssemblyStorageMap' : [ 0x204, ['pointer', ['void']]], - 'MinimumStackCommit' : [ 0x208, ['unsigned long']], -} ], - '_PROCESSOR_POWER_STATE' : [ 0x120, { - 'IdleFunction' : [ 0x0, ['pointer', ['void']]], - 'Idle0KernelTimeLimit' : [ 0x4, ['unsigned long']], - 'Idle0LastTime' : [ 0x8, ['unsigned long']], - 'IdleHandlers' : [ 0xc, ['pointer', ['void']]], - 'IdleState' : [ 0x10, ['pointer', ['void']]], - 'IdleHandlersCount' : [ 0x14, ['unsigned long']], - 'LastCheck' : [ 0x18, ['unsigned long long']], - 'IdleTimes' : [ 0x20, ['PROCESSOR_IDLE_TIMES']], - 'IdleTime1' : [ 0x40, ['unsigned long']], - 'PromotionCheck' : [ 0x44, ['unsigned long']], - 'IdleTime2' : [ 0x48, ['unsigned long']], - 'CurrentThrottle' : [ 0x4c, ['unsigned char']], - 'ThermalThrottleLimit' : [ 0x4d, ['unsigned char']], - 'CurrentThrottleIndex' : [ 0x4e, ['unsigned char']], - 'ThermalThrottleIndex' : [ 0x4f, ['unsigned char']], - 'LastKernelUserTime' : [ 0x50, ['unsigned long']], - 'LastIdleThreadKernelTime' : [ 0x54, ['unsigned long']], - 'PackageIdleStartTime' : [ 0x58, ['unsigned long']], - 'PackageIdleTime' : [ 0x5c, ['unsigned long']], - 'DebugCount' : [ 0x60, ['unsigned long']], - 'LastSysTime' : [ 0x64, ['unsigned long']], - 'TotalIdleStateTime' : [ 0x68, ['array', 3, ['unsigned long long']]], - 'TotalIdleTransitions' : [ 0x80, ['array', 3, ['unsigned long']]], - 'PreviousC3StateTime' : [ 0x90, ['unsigned long long']], - 'KneeThrottleIndex' : [ 0x98, ['unsigned char']], - 'ThrottleLimitIndex' : [ 0x99, ['unsigned char']], - 'PerfStatesCount' : [ 0x9a, ['unsigned char']], - 'ProcessorMinThrottle' : [ 0x9b, ['unsigned char']], - 'ProcessorMaxThrottle' : [ 0x9c, ['unsigned char']], - 'EnableIdleAccounting' : [ 0x9d, ['unsigned char']], - 'LastC3Percentage' : [ 0x9e, ['unsigned char']], - 'LastAdjustedBusyPercentage' : [ 0x9f, ['unsigned char']], - 'PromotionCount' : [ 0xa0, ['unsigned long']], - 'DemotionCount' : [ 0xa4, ['unsigned long']], - 'ErrorCount' : [ 0xa8, ['unsigned long']], - 'RetryCount' : [ 0xac, ['unsigned long']], - 'Flags' : [ 0xb0, ['unsigned long']], - 'PerfCounterFrequency' : [ 0xb8, ['_LARGE_INTEGER']], - 'PerfTickCount' : [ 0xc0, ['unsigned long']], - 'PerfTimer' : [ 0xc8, ['_KTIMER']], - 'PerfDpc' : [ 0xf0, ['_KDPC']], - 'PerfStates' : [ 0x110, ['pointer', ['PROCESSOR_PERF_STATE']]], - 'PerfSetThrottle' : [ 0x114, ['pointer', ['void']]], - 'LastC3KernelUserTime' : [ 0x118, ['unsigned long']], - 'LastPackageIdleTime' : [ 0x11c, ['unsigned long']], -} ], - '_HHIVE' : [ 0x210, { - 'Signature' : [ 0x0, ['unsigned long']], - 'GetCellRoutine' : [ 0x4, ['pointer', ['void']]], - 'ReleaseCellRoutine' : [ 0x8, ['pointer', ['void']]], - 'Allocate' : [ 0xc, ['pointer', ['void']]], - 'Free' : [ 0x10, ['pointer', ['void']]], - 'FileSetSize' : [ 0x14, ['pointer', ['void']]], - 'FileWrite' : [ 0x18, ['pointer', ['void']]], - 'FileRead' : [ 0x1c, ['pointer', ['void']]], - 'FileFlush' : [ 0x20, ['pointer', ['void']]], - 'BaseBlock' : [ 0x24, ['pointer', ['_HBASE_BLOCK']]], - 'DirtyVector' : [ 0x28, ['_RTL_BITMAP']], - 'DirtyCount' : [ 0x30, ['unsigned long']], - 'DirtyAlloc' : [ 0x34, ['unsigned long']], - 'RealWrites' : [ 0x38, ['unsigned char']], - 'Cluster' : [ 0x3c, ['unsigned long']], - 'Flat' : [ 0x40, ['unsigned char']], - 'ReadOnly' : [ 0x41, ['unsigned char']], - 'Log' : [ 0x42, ['unsigned char']], - 'HiveFlags' : [ 0x44, ['unsigned long']], - 'LogSize' : [ 0x48, ['unsigned long']], - 'RefreshCount' : [ 0x4c, ['unsigned long']], - 'StorageTypeCount' : [ 0x50, ['unsigned long']], - 'Version' : [ 0x54, ['unsigned long']], - 'Storage' : [ 0x58, ['array', 2, ['_DUAL']]], -} ], - '_DRIVER_OBJECT' : [ 0xa8, { - 'Type' : [ 0x0, ['short']], - 'Size' : [ 0x2, ['short']], - 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], - 'Flags' : [ 0x8, ['unsigned long']], - 'DriverStart' : [ 0xc, ['pointer', ['void']]], - 'DriverSize' : [ 0x10, ['unsigned long']], - 'DriverSection' : [ 0x14, ['pointer', ['void']]], - 'DriverExtension' : [ 0x18, ['pointer', ['_DRIVER_EXTENSION']]], - 'DriverName' : [ 0x1c, ['_UNICODE_STRING']], - 'HardwareDatabase' : [ 0x24, ['pointer', ['_UNICODE_STRING']]], - 'FastIoDispatch' : [ 0x28, ['pointer', ['_FAST_IO_DISPATCH']]], - 'DriverInit' : [ 0x2c, ['pointer', ['void']]], - 'DriverStartIo' : [ 0x30, ['pointer', ['void']]], - 'DriverUnload' : [ 0x34, ['pointer', ['void']]], - 'MajorFunction' : [ 0x38, ['array', 28, ['pointer', ['void']]]], -} ], - '_MMFREE_POOL_ENTRY' : [ 0x14, { - 'List' : [ 0x0, ['_LIST_ENTRY']], - 'Size' : [ 0x8, ['unsigned long']], - 'Signature' : [ 0xc, ['unsigned long']], - 'Owner' : [ 0x10, ['pointer', ['_MMFREE_POOL_ENTRY']]], -} ], - '_OBJECT_TYPE_INITIALIZER' : [ 0x4c, { - 'Length' : [ 0x0, ['unsigned short']], - 'UseDefaultObject' : [ 0x2, ['unsigned char']], - 'CaseInsensitive' : [ 0x3, ['unsigned char']], - 'InvalidAttributes' : [ 0x4, ['unsigned long']], - 'GenericMapping' : [ 0x8, ['_GENERIC_MAPPING']], - 'ValidAccessMask' : [ 0x18, ['unsigned long']], - 'SecurityRequired' : [ 0x1c, ['unsigned char']], - 'MaintainHandleCount' : [ 0x1d, ['unsigned char']], - 'MaintainTypeList' : [ 0x1e, ['unsigned char']], - 'PoolType' : [ 0x20, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], - 'DefaultPagedPoolCharge' : [ 0x24, ['unsigned long']], - 'DefaultNonPagedPoolCharge' : [ 0x28, ['unsigned long']], - 'DumpProcedure' : [ 0x2c, ['pointer', ['void']]], - 'OpenProcedure' : [ 0x30, ['pointer', ['void']]], - 'CloseProcedure' : [ 0x34, ['pointer', ['void']]], - 'DeleteProcedure' : [ 0x38, ['pointer', ['void']]], - 'ParseProcedure' : [ 0x3c, ['pointer', ['void']]], - 'SecurityProcedure' : [ 0x40, ['pointer', ['void']]], - 'QueryNameProcedure' : [ 0x44, ['pointer', ['void']]], - 'OkayToCloseProcedure' : [ 0x48, ['pointer', ['void']]], -} ], - '_EXCEPTION_REGISTRATION_RECORD' : [ 0x8, { - 'Next' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], - 'Handler' : [ 0x4, ['pointer', ['void']]], -} ], - '_MMBANKED_SECTION' : [ 0x20, { - 'BasePhysicalPage' : [ 0x0, ['unsigned long']], - 'BasedPte' : [ 0x4, ['pointer', ['_MMPTE']]], - 'BankSize' : [ 0x8, ['unsigned long']], - 'BankShift' : [ 0xc, ['unsigned long']], - 'BankedRoutine' : [ 0x10, ['pointer', ['void']]], - 'Context' : [ 0x14, ['pointer', ['void']]], - 'CurrentMappedPte' : [ 0x18, ['pointer', ['_MMPTE']]], - 'BankTemplate' : [ 0x1c, ['array', 1, ['_MMPTE']]], -} ], - '_SYSPTES_HEADER' : [ 0xc, { - 'ListHead' : [ 0x0, ['_LIST_ENTRY']], - 'Count' : [ 0x8, ['unsigned long']], -} ], - '_WAIT_CONTEXT_BLOCK' : [ 0x28, { - 'WaitQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], - 'DeviceRoutine' : [ 0x10, ['pointer', ['void']]], - 'DeviceContext' : [ 0x14, ['pointer', ['void']]], - 'NumberOfMapRegisters' : [ 0x18, ['unsigned long']], - 'DeviceObject' : [ 0x1c, ['pointer', ['void']]], - 'CurrentIrp' : [ 0x20, ['pointer', ['void']]], - 'BufferChainingDpc' : [ 0x24, ['pointer', ['_KDPC']]], -} ], - '_KDPC' : [ 0x20, { - 'Type' : [ 0x0, ['short']], - 'Number' : [ 0x2, ['unsigned char']], - 'Importance' : [ 0x3, ['unsigned char']], - 'DpcListEntry' : [ 0x4, ['_LIST_ENTRY']], - 'DeferredRoutine' : [ 0xc, ['pointer', ['void']]], - 'DeferredContext' : [ 0x10, ['pointer', ['void']]], - 'SystemArgument1' : [ 0x14, ['pointer', ['void']]], - 'SystemArgument2' : [ 0x18, ['pointer', ['void']]], - 'Lock' : [ 0x1c, ['pointer', ['unsigned long']]], -} ], - '_PCI_BUS_INTERFACE_STANDARD' : [ 0x20, { - 'Size' : [ 0x0, ['unsigned short']], - 'Version' : [ 0x2, ['unsigned short']], - 'Context' : [ 0x4, ['pointer', ['void']]], - 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], - 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], - 'ReadConfig' : [ 0x10, ['pointer', ['void']]], - 'WriteConfig' : [ 0x14, ['pointer', ['void']]], - 'PinToLine' : [ 0x18, ['pointer', ['void']]], - 'LineToPin' : [ 0x1c, ['pointer', ['void']]], -} ], - '_WORK_QUEUE_ITEM' : [ 0x10, { - 'List' : [ 0x0, ['_LIST_ENTRY']], - 'WorkerRoutine' : [ 0x8, ['pointer', ['void']]], - 'Parameter' : [ 0xc, ['pointer', ['void']]], -} ], - '_IRP' : [ 0x70, { - 'Type' : [ 0x0, ['short']], - 'Size' : [ 0x2, ['unsigned short']], - 'MdlAddress' : [ 0x4, ['pointer', ['_MDL']]], - 'Flags' : [ 0x8, ['unsigned long']], - 'AssociatedIrp' : [ 0xc, ['__unnamed_1555']], - 'ThreadListEntry' : [ 0x10, ['_LIST_ENTRY']], - 'IoStatus' : [ 0x18, ['_IO_STATUS_BLOCK']], - 'RequestorMode' : [ 0x20, ['unsigned char']], - 'PendingReturned' : [ 0x21, ['unsigned char']], - 'StackCount' : [ 0x22, ['unsigned char']], - 'CurrentLocation' : [ 0x23, ['unsigned char']], - 'Cancel' : [ 0x24, ['unsigned char']], - 'CancelIrql' : [ 0x25, ['unsigned char']], - 'ApcEnvironment' : [ 0x26, ['unsigned char']], - 'AllocationFlags' : [ 0x27, ['unsigned char']], - 'UserIosb' : [ 0x28, ['pointer', ['_IO_STATUS_BLOCK']]], - 'UserEvent' : [ 0x2c, ['pointer', ['_KEVENT']]], - 'Overlay' : [ 0x30, ['__unnamed_155e']], - 'CancelRoutine' : [ 0x38, ['pointer', ['void']]], - 'UserBuffer' : [ 0x3c, ['pointer', ['void']]], - 'Tail' : [ 0x40, ['__unnamed_1565']], -} ], - '_FAST_IO_DISPATCH' : [ 0x70, { - 'SizeOfFastIoDispatch' : [ 0x0, ['unsigned long']], - 'FastIoCheckIfPossible' : [ 0x4, ['pointer', ['void']]], - 'FastIoRead' : [ 0x8, ['pointer', ['void']]], - 'FastIoWrite' : [ 0xc, ['pointer', ['void']]], - 'FastIoQueryBasicInfo' : [ 0x10, ['pointer', ['void']]], - 'FastIoQueryStandardInfo' : [ 0x14, ['pointer', ['void']]], - 'FastIoLock' : [ 0x18, ['pointer', ['void']]], - 'FastIoUnlockSingle' : [ 0x1c, ['pointer', ['void']]], - 'FastIoUnlockAll' : [ 0x20, ['pointer', ['void']]], - 'FastIoUnlockAllByKey' : [ 0x24, ['pointer', ['void']]], - 'FastIoDeviceControl' : [ 0x28, ['pointer', ['void']]], - 'AcquireFileForNtCreateSection' : [ 0x2c, ['pointer', ['void']]], - 'ReleaseFileForNtCreateSection' : [ 0x30, ['pointer', ['void']]], - 'FastIoDetachDevice' : [ 0x34, ['pointer', ['void']]], - 'FastIoQueryNetworkOpenInfo' : [ 0x38, ['pointer', ['void']]], - 'AcquireForModWrite' : [ 0x3c, ['pointer', ['void']]], - 'MdlRead' : [ 0x40, ['pointer', ['void']]], - 'MdlReadComplete' : [ 0x44, ['pointer', ['void']]], - 'PrepareMdlWrite' : [ 0x48, ['pointer', ['void']]], - 'MdlWriteComplete' : [ 0x4c, ['pointer', ['void']]], - 'FastIoReadCompressed' : [ 0x50, ['pointer', ['void']]], - 'FastIoWriteCompressed' : [ 0x54, ['pointer', ['void']]], - 'MdlReadCompleteCompressed' : [ 0x58, ['pointer', ['void']]], - 'MdlWriteCompleteCompressed' : [ 0x5c, ['pointer', ['void']]], - 'FastIoQueryOpen' : [ 0x60, ['pointer', ['void']]], - 'ReleaseForModWrite' : [ 0x64, ['pointer', ['void']]], - 'AcquireForCcFlush' : [ 0x68, ['pointer', ['void']]], - 'ReleaseForCcFlush' : [ 0x6c, ['pointer', ['void']]], -} ], - '_CACHE_MANAGER_CALLBACKS' : [ 0x10, { - 'AcquireForLazyWrite' : [ 0x0, ['pointer', ['void']]], - 'ReleaseFromLazyWrite' : [ 0x4, ['pointer', ['void']]], - 'AcquireForReadAhead' : [ 0x8, ['pointer', ['void']]], - 'ReleaseFromReadAhead' : [ 0xc, ['pointer', ['void']]], -} ], - '_KINTERRUPT' : [ 0x1e4, { - 'Type' : [ 0x0, ['short']], - 'Size' : [ 0x2, ['short']], - 'InterruptListEntry' : [ 0x4, ['_LIST_ENTRY']], - 'ServiceRoutine' : [ 0xc, ['pointer', ['void']]], - 'ServiceContext' : [ 0x10, ['pointer', ['void']]], - 'SpinLock' : [ 0x14, ['unsigned long']], - 'TickCount' : [ 0x18, ['unsigned long']], - 'ActualLock' : [ 0x1c, ['pointer', ['unsigned long']]], - 'DispatchAddress' : [ 0x20, ['pointer', ['void']]], - 'Vector' : [ 0x24, ['unsigned long']], - 'Irql' : [ 0x28, ['unsigned char']], - 'SynchronizeIrql' : [ 0x29, ['unsigned char']], - 'FloatingSave' : [ 0x2a, ['unsigned char']], - 'Connected' : [ 0x2b, ['unsigned char']], - 'Number' : [ 0x2c, ['unsigned char']], - 'ShareVector' : [ 0x2d, ['unsigned char']], - 'Mode' : [ 0x30, ['Enumeration', dict(target = 'long', choices = {0: 'LevelSensitive', 1: 'Latched'})]], - 'ServiceCount' : [ 0x34, ['unsigned long']], - 'DispatchCount' : [ 0x38, ['unsigned long']], - 'DispatchCode' : [ 0x3c, ['array', 106, ['unsigned long']]], -} ], - '_PCI_MJ_DISPATCH_TABLE' : [ 0x20, { - 'PnpIrpMaximumMinorFunction' : [ 0x0, ['unsigned long']], - 'PnpIrpDispatchTable' : [ 0x4, ['pointer', ['_PCI_MN_DISPATCH_TABLE']]], - 'PowerIrpMaximumMinorFunction' : [ 0x8, ['unsigned long']], - 'PowerIrpDispatchTable' : [ 0xc, ['pointer', ['_PCI_MN_DISPATCH_TABLE']]], - 'SystemControlIrpDispatchStyle' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {0: 'IRP_COMPLETE', 1: 'IRP_DOWNWARD', 2: 'IRP_UPWARD', 3: 'IRP_DISPATCH'})]], - 'SystemControlIrpDispatchFunction' : [ 0x14, ['pointer', ['void']]], - 'OtherIrpDispatchStyle' : [ 0x18, ['Enumeration', dict(target = 'long', choices = {0: 'IRP_COMPLETE', 1: 'IRP_DOWNWARD', 2: 'IRP_UPWARD', 3: 'IRP_DISPATCH'})]], - 'OtherIrpDispatchFunction' : [ 0x1c, ['pointer', ['void']]], -} ], - '_IO_TIMER' : [ 0x18, { - 'Type' : [ 0x0, ['short']], - 'TimerFlag' : [ 0x2, ['short']], - 'TimerList' : [ 0x4, ['_LIST_ENTRY']], - 'TimerRoutine' : [ 0xc, ['pointer', ['void']]], - 'Context' : [ 0x10, ['pointer', ['void']]], - 'DeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], -} ], - '_ARBITER_INTERFACE' : [ 0x18, { - 'Size' : [ 0x0, ['unsigned short']], - 'Version' : [ 0x2, ['unsigned short']], - 'Context' : [ 0x4, ['pointer', ['void']]], - 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], - 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], - 'ArbiterHandler' : [ 0x10, ['pointer', ['void']]], - 'Flags' : [ 0x14, ['unsigned long']], -} ], - 'PCI_SECONDARY_EXTENSION' : [ 0xc, { - 'List' : [ 0x0, ['_SINGLE_LIST_ENTRY']], - 'ExtensionType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1768116272: 'PciPdoExtensionType', 1768116273: 'PciFdoExtensionType', 1768116274: 'PciArb_Io', 1768116275: 'PciArb_Memory', 1768116276: 'PciArb_Interrupt', 1768116277: 'PciArb_BusNumber', 1768116278: 'PciTrans_Interrupt', 1768116279: 'PciInterface_BusHandler', 1768116280: 'PciInterface_IntRouteHandler', 1768116281: 'PciInterface_PciCb', 1768116282: 'PciInterface_LegacyDeviceDetection', 1768116283: 'PciInterface_PmeHandler', 1768116284: 'PciInterface_DevicePresent', 1768116285: 'PciInterface_NativeIde', 1768116286: 'PciInterface_AgpTarget'})]], - 'Destructor' : [ 0x8, ['pointer', ['void']]], -} ], - '_PCI_INTERFACE' : [ 0x1c, { - 'InterfaceType' : [ 0x0, ['pointer', ['_GUID']]], - 'MinSize' : [ 0x4, ['unsigned short']], - 'MinVersion' : [ 0x6, ['unsigned short']], - 'MaxVersion' : [ 0x8, ['unsigned short']], - 'Flags' : [ 0xa, ['unsigned short']], - 'ReferenceCount' : [ 0xc, ['long']], - 'Signature' : [ 0x10, ['Enumeration', dict(target = 'long', choices = {1768116272: 'PciPdoExtensionType', 1768116273: 'PciFdoExtensionType', 1768116274: 'PciArb_Io', 1768116275: 'PciArb_Memory', 1768116276: 'PciArb_Interrupt', 1768116277: 'PciArb_BusNumber', 1768116278: 'PciTrans_Interrupt', 1768116279: 'PciInterface_BusHandler', 1768116280: 'PciInterface_IntRouteHandler', 1768116281: 'PciInterface_PciCb', 1768116282: 'PciInterface_LegacyDeviceDetection', 1768116283: 'PciInterface_PmeHandler', 1768116284: 'PciInterface_DevicePresent', 1768116285: 'PciInterface_NativeIde', 1768116286: 'PciInterface_AgpTarget'})]], - 'Constructor' : [ 0x14, ['pointer', ['void']]], - 'Initializer' : [ 0x18, ['pointer', ['void']]], -} ], - '_PNP_DEVICE_EVENT_ENTRY' : [ 0x58, { - 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], - 'Argument' : [ 0x8, ['unsigned long']], - 'CallerEvent' : [ 0xc, ['pointer', ['_KEVENT']]], - 'Callback' : [ 0x10, ['pointer', ['void']]], - 'Context' : [ 0x14, ['pointer', ['void']]], - 'VetoType' : [ 0x18, ['pointer', ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]]], - 'VetoName' : [ 0x1c, ['pointer', ['_UNICODE_STRING']]], - 'Data' : [ 0x20, ['_PLUGPLAY_EVENT_BLOCK']], -} ], - '_ARBITER_INSTANCE' : [ 0x9c, { - 'Signature' : [ 0x0, ['unsigned long']], - 'MutexEvent' : [ 0x4, ['pointer', ['_KEVENT']]], - 'Name' : [ 0x8, ['pointer', ['unsigned short']]], - 'ResourceType' : [ 0xc, ['long']], - 'Allocation' : [ 0x10, ['pointer', ['_RTL_RANGE_LIST']]], - 'PossibleAllocation' : [ 0x14, ['pointer', ['_RTL_RANGE_LIST']]], - 'OrderingList' : [ 0x18, ['_ARBITER_ORDERING_LIST']], - 'ReservedList' : [ 0x20, ['_ARBITER_ORDERING_LIST']], - 'ReferenceCount' : [ 0x28, ['long']], - 'Interface' : [ 0x2c, ['pointer', ['_ARBITER_INTERFACE']]], - 'AllocationStackMaxSize' : [ 0x30, ['unsigned long']], - 'AllocationStack' : [ 0x34, ['pointer', ['_ARBITER_ALLOCATION_STATE']]], - 'UnpackRequirement' : [ 0x38, ['pointer', ['void']]], - 'PackResource' : [ 0x3c, ['pointer', ['void']]], - 'UnpackResource' : [ 0x40, ['pointer', ['void']]], - 'ScoreRequirement' : [ 0x44, ['pointer', ['void']]], - 'TestAllocation' : [ 0x48, ['pointer', ['void']]], - 'RetestAllocation' : [ 0x4c, ['pointer', ['void']]], - 'CommitAllocation' : [ 0x50, ['pointer', ['void']]], - 'RollbackAllocation' : [ 0x54, ['pointer', ['void']]], - 'BootAllocation' : [ 0x58, ['pointer', ['void']]], - 'QueryArbitrate' : [ 0x5c, ['pointer', ['void']]], - 'QueryConflict' : [ 0x60, ['pointer', ['void']]], - 'AddReserved' : [ 0x64, ['pointer', ['void']]], - 'StartArbiter' : [ 0x68, ['pointer', ['void']]], - 'PreprocessEntry' : [ 0x6c, ['pointer', ['void']]], - 'AllocateEntry' : [ 0x70, ['pointer', ['void']]], - 'GetNextAllocationRange' : [ 0x74, ['pointer', ['void']]], - 'FindSuitableRange' : [ 0x78, ['pointer', ['void']]], - 'AddAllocation' : [ 0x7c, ['pointer', ['void']]], - 'BacktrackAllocation' : [ 0x80, ['pointer', ['void']]], - 'OverrideConflict' : [ 0x84, ['pointer', ['void']]], - 'TransactionInProgress' : [ 0x88, ['unsigned char']], - 'Extension' : [ 0x8c, ['pointer', ['void']]], - 'BusDeviceObject' : [ 0x90, ['pointer', ['_DEVICE_OBJECT']]], - 'ConflictCallbackContext' : [ 0x94, ['pointer', ['void']]], - 'ConflictCallback' : [ 0x98, ['pointer', ['void']]], -} ], - '_BUS_HANDLER' : [ 0x6c, { - 'Version' : [ 0x0, ['unsigned long']], - 'InterfaceType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'Internal', 1: 'Isa', 2: 'Eisa', 3: 'MicroChannel', 4: 'TurboChannel', 5: 'PCIBus', 6: 'VMEBus', 7: 'NuBus', 8: 'PCMCIABus', 9: 'CBus', 10: 'MPIBus', 11: 'MPSABus', 12: 'ProcessorInternal', 13: 'InternalPowerBus', 14: 'PNPISABus', 15: 'PNPBus', 16: 'MaximumInterfaceType', -1: 'InterfaceTypeUndefined'})]], - 'ConfigurationType' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'Cmos', 1: 'EisaConfiguration', 2: 'Pos', 3: 'CbusConfiguration', 4: 'PCIConfiguration', 5: 'VMEConfiguration', 6: 'NuBusConfiguration', 7: 'PCMCIAConfiguration', 8: 'MPIConfiguration', 9: 'MPSAConfiguration', 10: 'PNPISAConfiguration', 11: 'SgiInternalConfiguration', 12: 'MaximumBusDataType', -1: 'ConfigurationSpaceUndefined'})]], - 'BusNumber' : [ 0xc, ['unsigned long']], - 'DeviceObject' : [ 0x10, ['pointer', ['_DEVICE_OBJECT']]], - 'ParentHandler' : [ 0x14, ['pointer', ['_BUS_HANDLER']]], - 'BusData' : [ 0x18, ['pointer', ['void']]], - 'DeviceControlExtensionSize' : [ 0x1c, ['unsigned long']], - 'BusAddresses' : [ 0x20, ['pointer', ['_SUPPORTED_RANGES']]], - 'Reserved' : [ 0x24, ['array', 4, ['unsigned long']]], - 'GetBusData' : [ 0x34, ['pointer', ['void']]], - 'SetBusData' : [ 0x38, ['pointer', ['void']]], - 'AdjustResourceList' : [ 0x3c, ['pointer', ['void']]], - 'AssignSlotResources' : [ 0x40, ['pointer', ['void']]], - 'GetInterruptVector' : [ 0x44, ['pointer', ['void']]], - 'TranslateBusAddress' : [ 0x48, ['pointer', ['void']]], - 'Spare1' : [ 0x4c, ['pointer', ['void']]], - 'Spare2' : [ 0x50, ['pointer', ['void']]], - 'Spare3' : [ 0x54, ['pointer', ['void']]], - 'Spare4' : [ 0x58, ['pointer', ['void']]], - 'Spare5' : [ 0x5c, ['pointer', ['void']]], - 'Spare6' : [ 0x60, ['pointer', ['void']]], - 'Spare7' : [ 0x64, ['pointer', ['void']]], - 'Spare8' : [ 0x68, ['pointer', ['void']]], -} ], - '_PCI_MN_DISPATCH_TABLE' : [ 0x8, { - 'DispatchStyle' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'IRP_COMPLETE', 1: 'IRP_DOWNWARD', 2: 'IRP_UPWARD', 3: 'IRP_DISPATCH'})]], - 'DispatchFunction' : [ 0x4, ['pointer', ['void']]], -} ], - 'PCI_POWER_STATE' : [ 0x40, { - 'CurrentSystemState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'CurrentDeviceState' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], - 'SystemWakeLevel' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], - 'DeviceWakeLevel' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]], - 'SystemStateMapping' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], - 'WaitWakeIrp' : [ 0x2c, ['pointer', ['_IRP']]], - 'SavedCancelRoutine' : [ 0x30, ['pointer', ['void']]], - 'Paging' : [ 0x34, ['long']], - 'Hibernate' : [ 0x38, ['long']], - 'CrashDump' : [ 0x3c, ['long']], -} ], - '_IO_STACK_LOCATION' : [ 0x24, { - 'MajorFunction' : [ 0x0, ['unsigned char']], - 'MinorFunction' : [ 0x1, ['unsigned char']], - 'Flags' : [ 0x2, ['unsigned char']], - 'Control' : [ 0x3, ['unsigned char']], - 'Parameters' : [ 0x4, ['__unnamed_1831']], - 'DeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], - 'FileObject' : [ 0x18, ['pointer', ['_FILE_OBJECT']]], - 'CompletionRoutine' : [ 0x1c, ['pointer', ['void']]], - 'Context' : [ 0x20, ['pointer', ['void']]], -} ], - '_DRIVER_EXTENSION' : [ 0x1c, { - 'DriverObject' : [ 0x0, ['pointer', ['_DRIVER_OBJECT']]], - 'AddDevice' : [ 0x4, ['pointer', ['void']]], - 'Count' : [ 0x8, ['unsigned long']], - 'ServiceKeyName' : [ 0xc, ['_UNICODE_STRING']], - 'ClientDriverExtension' : [ 0x14, ['pointer', ['_IO_CLIENT_EXTENSION']]], - 'FsFilterCallbacks' : [ 0x18, ['pointer', ['_FS_FILTER_CALLBACKS']]], -} ], - '_INTERFACE' : [ 0x10, { - 'Size' : [ 0x0, ['unsigned short']], - 'Version' : [ 0x2, ['unsigned short']], - 'Context' : [ 0x4, ['pointer', ['void']]], - 'InterfaceReference' : [ 0x8, ['pointer', ['void']]], - 'InterfaceDereference' : [ 0xc, ['pointer', ['void']]], -} ], - '_DUMP_INITIALIZATION_CONTEXT' : [ 0x70, { - 'Length' : [ 0x0, ['unsigned long']], - 'Reserved' : [ 0x4, ['unsigned long']], - 'MemoryBlock' : [ 0x8, ['pointer', ['void']]], - 'CommonBuffer' : [ 0xc, ['array', 2, ['pointer', ['void']]]], - 'PhysicalAddress' : [ 0x18, ['array', 2, ['_LARGE_INTEGER']]], - 'StallRoutine' : [ 0x28, ['pointer', ['void']]], - 'OpenRoutine' : [ 0x2c, ['pointer', ['void']]], - 'WriteRoutine' : [ 0x30, ['pointer', ['void']]], - 'FinishRoutine' : [ 0x34, ['pointer', ['void']]], - 'AdapterObject' : [ 0x38, ['pointer', ['_ADAPTER_OBJECT']]], - 'MappedRegisterBase' : [ 0x3c, ['pointer', ['void']]], - 'PortConfiguration' : [ 0x40, ['pointer', ['void']]], - 'CrashDump' : [ 0x44, ['unsigned char']], - 'MaximumTransferSize' : [ 0x48, ['unsigned long']], - 'CommonBufferSize' : [ 0x4c, ['unsigned long']], - 'TargetAddress' : [ 0x50, ['pointer', ['void']]], - 'WritePendingRoutine' : [ 0x54, ['pointer', ['void']]], - 'PartitionStyle' : [ 0x58, ['unsigned long']], - 'DiskInfo' : [ 0x5c, ['__unnamed_192f']], -} ], - '_FS_FILTER_CALLBACKS' : [ 0x38, { - 'SizeOfFsFilterCallbacks' : [ 0x0, ['unsigned long']], - 'Reserved' : [ 0x4, ['unsigned long']], - 'PreAcquireForSectionSynchronization' : [ 0x8, ['pointer', ['void']]], - 'PostAcquireForSectionSynchronization' : [ 0xc, ['pointer', ['void']]], - 'PreReleaseForSectionSynchronization' : [ 0x10, ['pointer', ['void']]], - 'PostReleaseForSectionSynchronization' : [ 0x14, ['pointer', ['void']]], - 'PreAcquireForCcFlush' : [ 0x18, ['pointer', ['void']]], - 'PostAcquireForCcFlush' : [ 0x1c, ['pointer', ['void']]], - 'PreReleaseForCcFlush' : [ 0x20, ['pointer', ['void']]], - 'PostReleaseForCcFlush' : [ 0x24, ['pointer', ['void']]], - 'PreAcquireForModifiedPageWriter' : [ 0x28, ['pointer', ['void']]], - 'PostAcquireForModifiedPageWriter' : [ 0x2c, ['pointer', ['void']]], - 'PreReleaseForModifiedPageWriter' : [ 0x30, ['pointer', ['void']]], - 'PostReleaseForModifiedPageWriter' : [ 0x34, ['pointer', ['void']]], } ], } diff --git a/volatility/plugins/overlays/windows/xp_sp3_x86_vtypes.py b/volatility/plugins/overlays/windows/xp_sp3_x86_vtypes.py index ab120e07..a1717205 100644 --- a/volatility/plugins/overlays/windows/xp_sp3_x86_vtypes.py +++ b/volatility/plugins/overlays/windows/xp_sp3_x86_vtypes.py @@ -1,4 +1,4 @@ -nt_types = { +ntkrnlmp_types = { 'LIST_ENTRY64' : [ 0x10, { 'Flink' : [ 0x0, ['unsigned long long']], 'Blink' : [ 0x8, ['unsigned long long']], @@ -58,56 +58,6 @@ nt_types = { } ], '_SINGLE_LIST_ENTRY' : [ 0x4, { 'Next' : [ 0x0, ['pointer', ['_SINGLE_LIST_ENTRY']]], -} ], - '_HARDWARE_PTE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], -} ], - '_SLIST_HEADER' : [ 0x8, { - 'Alignment' : [ 0x0, ['unsigned long long']], - 'Next' : [ 0x0, ['_SINGLE_LIST_ENTRY']], - 'Depth' : [ 0x4, ['unsigned short']], - 'Sequence' : [ 0x6, ['unsigned short']], -} ], - '_NPAGED_LOOKASIDE_LIST' : [ 0x100, { - 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], - 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['unsigned long']], -} ], - '_PAGED_LOOKASIDE_LIST' : [ 0x100, { - 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], - 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['_FAST_MUTEX']], -} ], - '_GENERAL_LOOKASIDE' : [ 0x80, { - 'ListHead' : [ 0x0, ['_SLIST_HEADER']], - 'Depth' : [ 0x8, ['unsigned short']], - 'MaximumDepth' : [ 0xa, ['unsigned short']], - 'TotalAllocates' : [ 0xc, ['unsigned long']], - 'AllocateMisses' : [ 0x10, ['unsigned long']], - 'AllocateHits' : [ 0x10, ['unsigned long']], - 'TotalFrees' : [ 0x14, ['unsigned long']], - 'FreeMisses' : [ 0x18, ['unsigned long']], - 'FreeHits' : [ 0x18, ['unsigned long']], - 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], - 'Tag' : [ 0x20, ['unsigned long']], - 'Size' : [ 0x24, ['unsigned long']], - 'Allocate' : [ 0x28, ['pointer', ['void']]], - 'Free' : [ 0x2c, ['pointer', ['void']]], - 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], - 'LastTotalAllocates' : [ 0x38, ['unsigned long']], - 'LastAllocateMisses' : [ 0x3c, ['unsigned long']], - 'LastAllocateHits' : [ 0x3c, ['unsigned long']], - 'Future' : [ 0x40, ['array', 2, ['unsigned long']]], } ], '_KPRCB' : [ 0xc50, { 'MinorVersion' : [ 0x0, ['unsigned short']], @@ -201,6 +151,41 @@ nt_types = { 'UpdateSignature' : [ 0x918, ['_LARGE_INTEGER']], 'NpxSaveArea' : [ 0x920, ['_FX_SAVE_AREA']], 'PowerState' : [ 0xb30, ['_PROCESSOR_POWER_STATE']], +} ], + '_SLIST_HEADER' : [ 0x8, { + 'Alignment' : [ 0x0, ['unsigned long long']], + 'Next' : [ 0x0, ['_SINGLE_LIST_ENTRY']], + 'Depth' : [ 0x4, ['unsigned short']], + 'Sequence' : [ 0x6, ['unsigned short']], +} ], + '_NPAGED_LOOKASIDE_LIST' : [ 0x100, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], + 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['unsigned long']], +} ], + '_PAGED_LOOKASIDE_LIST' : [ 0x100, { + 'L' : [ 0x0, ['_GENERAL_LOOKASIDE']], + 'Lock__ObsoleteButDoNotDelete' : [ 0x80, ['_FAST_MUTEX']], +} ], + '_GENERAL_LOOKASIDE' : [ 0x80, { + 'ListHead' : [ 0x0, ['_SLIST_HEADER']], + 'Depth' : [ 0x8, ['unsigned short']], + 'MaximumDepth' : [ 0xa, ['unsigned short']], + 'TotalAllocates' : [ 0xc, ['unsigned long']], + 'AllocateMisses' : [ 0x10, ['unsigned long']], + 'AllocateHits' : [ 0x10, ['unsigned long']], + 'TotalFrees' : [ 0x14, ['unsigned long']], + 'FreeMisses' : [ 0x18, ['unsigned long']], + 'FreeHits' : [ 0x18, ['unsigned long']], + 'Type' : [ 0x1c, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], + 'Tag' : [ 0x20, ['unsigned long']], + 'Size' : [ 0x24, ['unsigned long']], + 'Allocate' : [ 0x28, ['pointer', ['void']]], + 'Free' : [ 0x2c, ['pointer', ['void']]], + 'ListEntry' : [ 0x30, ['_LIST_ENTRY']], + 'LastTotalAllocates' : [ 0x38, ['unsigned long']], + 'LastAllocateMisses' : [ 0x3c, ['unsigned long']], + 'LastAllocateHits' : [ 0x3c, ['unsigned long']], + 'Future' : [ 0x40, ['array', 2, ['unsigned long']]], } ], '_EX_RUNDOWN_REF' : [ 0x4, { 'Count' : [ 0x0, ['unsigned long']], @@ -208,13 +193,13 @@ nt_types = { } ], '_EX_FAST_REF' : [ 0x4, { 'Object' : [ 0x0, ['pointer', ['void']]], - 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], + 'RefCnt' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], } ], '_EX_PUSH_LOCK' : [ 0x4, { - 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Exclusive' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Shared' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'Waiting' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Exclusive' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Shared' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'Value' : [ 0x0, ['unsigned long']], 'Ptr' : [ 0x0, ['pointer', ['void']]], } ], @@ -224,14 +209,14 @@ nt_types = { 'ShareCount' : [ 0x14, ['unsigned long']], 'Exclusive' : [ 0x18, ['unsigned char']], } ], - '_EX_PUSH_LOCK_CACHE_AWARE' : [ 0x4, { - 'Locks' : [ 0x0, ['array', 1, ['pointer', ['_EX_PUSH_LOCK']]]], + '_EX_PUSH_LOCK_CACHE_AWARE' : [ 0x80, { + 'Locks' : [ 0x0, ['array', 32, ['pointer', ['_EX_PUSH_LOCK']]]], } ], '_ETHREAD' : [ 0x258, { 'Tcb' : [ 0x0, ['_KTHREAD']], 'CreateTime' : [ 0x1c0, ['_LARGE_INTEGER']], - 'NestedFaultCount' : [ 0x1c0, ['BitField', dict(start_bit = 0, end_bit = 2)]], - 'ApcNeeded' : [ 0x1c0, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'NestedFaultCount' : [ 0x1c0, ['BitField', dict(start_bit = 0, end_bit = 2, native_type='unsigned long')]], + 'ApcNeeded' : [ 0x1c0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'ExitTime' : [ 0x1c8, ['_LARGE_INTEGER']], 'LpcReplyChain' : [ 0x1c8, ['_LIST_ENTRY']], 'KeyedWaitChain' : [ 0x1c8, ['_LIST_ENTRY']], @@ -263,23 +248,23 @@ nt_types = { 'ReadClusterSize' : [ 0x240, ['unsigned long']], 'GrantedAccess' : [ 0x244, ['unsigned long']], 'CrossThreadFlags' : [ 0x248, ['unsigned long']], - 'Terminated' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeadThread' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'HideFromDebugger' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ActiveImpersonationInfo' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'SystemThread' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'HardErrorsAreDisabled' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'BreakOnTermination' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SkipCreationMsg' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'SkipTerminationMsg' : [ 0x248, ['BitField', dict(start_bit = 8, end_bit = 9)]], + 'Terminated' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeadThread' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'HideFromDebugger' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ActiveImpersonationInfo' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'SystemThread' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'HardErrorsAreDisabled' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SkipCreationMsg' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'SkipTerminationMsg' : [ 0x248, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], 'SameThreadPassiveFlags' : [ 0x24c, ['unsigned long']], - 'ActiveExWorker' : [ 0x24c, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExWorkerCanWaitUser' : [ 0x24c, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'MemoryMaker' : [ 0x24c, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'ActiveExWorker' : [ 0x24c, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ExWorkerCanWaitUser' : [ 0x24c, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'MemoryMaker' : [ 0x24c, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], 'SameThreadApcFlags' : [ 0x250, ['unsigned long']], - 'LpcReceivedMsgIdValid' : [ 0x250, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LpcExitThreadCalled' : [ 0x250, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'AddressSpaceOwner' : [ 0x250, ['BitField', dict(start_bit = 2, end_bit = 3)]], + 'LpcReceivedMsgIdValid' : [ 0x250, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'LpcExitThreadCalled' : [ 0x250, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'AddressSpaceOwner' : [ 0x250, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], 'ForwardClusterOnly' : [ 0x254, ['unsigned char']], 'DisablePageFaultClustering' : [ 0x255, ['unsigned char']], } ], @@ -356,33 +341,33 @@ nt_types = { 'NumberOfVads' : [ 0x240, ['unsigned long']], 'JobStatus' : [ 0x244, ['unsigned long']], 'Flags' : [ 0x248, ['unsigned long']], - 'CreateReported' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'NoDebugInherit' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'ProcessExiting' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'ProcessDelete' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Wow64SplitPages' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'VmDeleted' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'OutswapEnabled' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'Outswapped' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'ForkFailed' : [ 0x248, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'HasPhysicalVad' : [ 0x248, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'AddressSpaceInitialized' : [ 0x248, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'SetTimerResolution' : [ 0x248, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'BreakOnTermination' : [ 0x248, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'SessionCreationUnderway' : [ 0x248, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WriteWatch' : [ 0x248, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'ProcessInSession' : [ 0x248, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'OverrideAddressSpace' : [ 0x248, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'HasAddressSpace' : [ 0x248, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'LaunchPrefetched' : [ 0x248, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'InjectInpageErrors' : [ 0x248, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'VmTopDown' : [ 0x248, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Unused3' : [ 0x248, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Unused4' : [ 0x248, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'VdmAllowed' : [ 0x248, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'Unused' : [ 0x248, ['BitField', dict(start_bit = 25, end_bit = 30)]], - 'Unused1' : [ 0x248, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'Unused2' : [ 0x248, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CreateReported' : [ 0x248, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'NoDebugInherit' : [ 0x248, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'ProcessExiting' : [ 0x248, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'ProcessDelete' : [ 0x248, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Wow64SplitPages' : [ 0x248, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'VmDeleted' : [ 0x248, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'OutswapEnabled' : [ 0x248, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'Outswapped' : [ 0x248, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'ForkFailed' : [ 0x248, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'HasPhysicalVad' : [ 0x248, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'AddressSpaceInitialized' : [ 0x248, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'SetTimerResolution' : [ 0x248, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'BreakOnTermination' : [ 0x248, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'SessionCreationUnderway' : [ 0x248, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WriteWatch' : [ 0x248, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'ProcessInSession' : [ 0x248, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'OverrideAddressSpace' : [ 0x248, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'HasAddressSpace' : [ 0x248, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'LaunchPrefetched' : [ 0x248, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'InjectInpageErrors' : [ 0x248, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'VmTopDown' : [ 0x248, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Unused3' : [ 0x248, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Unused4' : [ 0x248, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'VdmAllowed' : [ 0x248, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'Unused' : [ 0x248, ['BitField', dict(start_bit = 25, end_bit = 30, native_type='unsigned long')]], + 'Unused1' : [ 0x248, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Unused2' : [ 0x248, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'ExitStatus' : [ 0x24c, ['long']], 'NextPageColor' : [ 0x250, ['unsigned short']], 'SubSystemMinorVersion' : [ 0x252, ['unsigned char']], @@ -493,16 +478,16 @@ nt_types = { 'IdealProcessor' : [ 0x1ba, ['unsigned char']], 'DisableBoost' : [ 0x1bb, ['unsigned char']], } ], - '__unnamed_10f8' : [ 0x208, { + '__unnamed_10f2' : [ 0x208, { 'FnArea' : [ 0x0, ['_FNSAVE_FORMAT']], 'FxArea' : [ 0x0, ['_FXSAVE_FORMAT']], } ], '_FX_SAVE_AREA' : [ 0x210, { - 'U' : [ 0x0, ['__unnamed_10f8']], + 'U' : [ 0x0, ['__unnamed_10f2']], 'NpxSavedCpu' : [ 0x208, ['unsigned long']], 'Cr0NpxState' : [ 0x20c, ['unsigned long']], } ], - '__unnamed_1104' : [ 0x4, { + '__unnamed_10fe' : [ 0x4, { 'Long' : [ 0x0, ['unsigned long']], 'Hard' : [ 0x0, ['_MMPTE_HARDWARE']], 'Flush' : [ 0x0, ['_HARDWARE_PTE']], @@ -513,7 +498,7 @@ nt_types = { 'List' : [ 0x0, ['_MMPTE_LIST']], } ], '_MMPTE' : [ 0x4, { - 'u' : [ 0x0, ['__unnamed_1104']], + 'u' : [ 0x0, ['__unnamed_10fe']], } ], '_EXCEPTION_RECORD64' : [ 0x98, { 'ExceptionCode' : [ 0x0, ['long']], @@ -642,7 +627,7 @@ nt_types = { 'MaxInstructions' : [ 0x14, ['unsigned long']], 'TotalInstructions' : [ 0x18, ['unsigned long']], } ], - '__unnamed_1175' : [ 0x28, { + '__unnamed_116f' : [ 0x28, { 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY64']], 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY64']], 'GetContext' : [ 0x0, ['_DBGKD_GET_CONTEXT']], @@ -670,9 +655,9 @@ nt_types = { 'ProcessorLevel' : [ 0x4, ['unsigned short']], 'Processor' : [ 0x6, ['unsigned short']], 'ReturnStatus' : [ 0x8, ['long']], - 'u' : [ 0x10, ['__unnamed_1175']], + 'u' : [ 0x10, ['__unnamed_116f']], } ], - '__unnamed_117c' : [ 0x28, { + '__unnamed_1176' : [ 0x28, { 'ReadMemory' : [ 0x0, ['_DBGKD_READ_MEMORY32']], 'WriteMemory' : [ 0x0, ['_DBGKD_WRITE_MEMORY32']], 'ReadMemory64' : [ 0x0, ['_DBGKD_READ_MEMORY64']], @@ -699,16 +684,16 @@ nt_types = { 'ProcessorLevel' : [ 0x4, ['unsigned short']], 'Processor' : [ 0x6, ['unsigned short']], 'ReturnStatus' : [ 0x8, ['long']], - 'u' : [ 0xc, ['__unnamed_117c']], + 'u' : [ 0xc, ['__unnamed_1176']], } ], - '__unnamed_1185' : [ 0x8, { + '__unnamed_117f' : [ 0x8, { 'FileOffset' : [ 0x0, ['_LARGE_INTEGER']], 'ActiveCount' : [ 0x0, ['unsigned short']], } ], '_VACB' : [ 0x18, { 'BaseAddress' : [ 0x0, ['pointer', ['void']]], 'SharedCacheMap' : [ 0x4, ['pointer', ['_SHARED_CACHE_MAP']]], - 'Overlay' : [ 0x8, ['__unnamed_1185']], + 'Overlay' : [ 0x8, ['__unnamed_117f']], 'LruList' : [ 0x10, ['_LIST_ENTRY']], } ], '_SHARED_CACHE_MAP' : [ 0x130, { @@ -767,11 +752,11 @@ nt_types = { 'UnusedBytes' : [ 0x6, ['unsigned char']], 'SegmentIndex' : [ 0x7, ['unsigned char']], } ], - '__unnamed_11af' : [ 0x10, { + '__unnamed_11a9' : [ 0x10, { 'FreeListsInUseUlong' : [ 0x0, ['array', 4, ['unsigned long']]], 'FreeListsInUseBytes' : [ 0x0, ['array', 16, ['unsigned char']]], } ], - '__unnamed_11b1' : [ 0x2, { + '__unnamed_11ab' : [ 0x2, { 'FreeListsInUseTerminate' : [ 0x0, ['unsigned short']], 'DecommitCount' : [ 0x0, ['unsigned short']], } ], @@ -799,8 +784,8 @@ nt_types = { 'AlignMask' : [ 0x4c, ['unsigned long']], 'VirtualAllocdBlocks' : [ 0x50, ['_LIST_ENTRY']], 'Segments' : [ 0x58, ['array', 64, ['pointer', ['_HEAP_SEGMENT']]]], - 'u' : [ 0x158, ['__unnamed_11af']], - 'u2' : [ 0x168, ['__unnamed_11b1']], + 'u' : [ 0x158, ['__unnamed_11a9']], + 'u2' : [ 0x168, ['__unnamed_11ab']], 'AllocatorBackTraceIndex' : [ 0x16a, ['unsigned short']], 'NonDedicatedListLength' : [ 0x16c, ['unsigned long']], 'LargeBlocksIndex' : [ 0x170, ['pointer', ['void']]], @@ -1037,7 +1022,7 @@ nt_types = { 'MmSectionFlags' : [ 0x24, ['pointer', ['_MMSECTION_FLAGS']]], 'MmSubSectionFlags' : [ 0x28, ['pointer', ['_MMSUBSECTION_FLAGS']]], } ], - '__unnamed_1248' : [ 0x4, { + '__unnamed_123f' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'Flags' : [ 0x0, ['_MMSECTION_FLAGS']], } ], @@ -1050,7 +1035,7 @@ nt_types = { 'NumberOfSubsections' : [ 0x18, ['unsigned short']], 'FlushInProgressCount' : [ 0x1a, ['unsigned short']], 'NumberOfUserReferences' : [ 0x1c, ['unsigned long']], - 'u' : [ 0x20, ['__unnamed_1248']], + 'u' : [ 0x20, ['__unnamed_123f']], 'FilePointer' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], 'WaitingForDeletion' : [ 0x28, ['pointer', ['_EVENT_COUNTER']]], 'ModifiedWriteCount' : [ 0x2c, ['unsigned short']], @@ -1070,13 +1055,13 @@ nt_types = { 'NextHandleNeedingPool' : [ 0x38, ['unsigned long']], 'HandleCount' : [ 0x3c, ['long']], 'Flags' : [ 0x40, ['unsigned long']], - 'StrictFIFO' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1)]], + 'StrictFIFO' : [ 0x40, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], } ], '_POOL_HEADER' : [ 0x8, { - 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16)]], - 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9)]], - 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16)]], + 'PreviousSize' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolIndex' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], + 'BlockSize' : [ 0x2, ['BitField', dict(start_bit = 0, end_bit = 9, native_type='unsigned short')]], + 'PoolType' : [ 0x2, ['BitField', dict(start_bit = 9, end_bit = 16, native_type='unsigned short')]], 'Ulong1' : [ 0x0, ['unsigned long']], 'ProcessBilled' : [ 0x4, ['pointer', ['_EPROCESS']]], 'PoolTag' : [ 0x4, ['unsigned long']], @@ -1092,12 +1077,12 @@ nt_types = { 'WaitType' : [ 0x16, ['unsigned short']], } ], '_MMPTE_PROTOTYPE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ProtoAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 8, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'ProtoAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 32, native_type='unsigned long')]], } ], '_MMSUPPORT' : [ 0x40, { 'LastTrimTime' : [ 0x0, ['_LARGE_INTEGER']], @@ -1124,14 +1109,14 @@ nt_types = { 'Info' : [ 0x38, ['EX_QUEUE_WORKER_INFO']], } ], '_MMSUBSECTION_FLAGS' : [ 0x4, { - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20)]], - 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32)]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadWrite' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SubsectionStatic' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 9, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'StartingSector4132' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 20, native_type='unsigned long')]], + 'SectorEndOffset' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 32, native_type='unsigned long')]], } ], '_KMUTANT' : [ 0x20, { 'Header' : [ 0x0, ['_DISPATCHER_HEADER']], @@ -1223,7 +1208,7 @@ nt_types = { 'NumberOfSubsections' : [ 0x18, ['unsigned short']], 'FlushInProgressCount' : [ 0x1a, ['unsigned short']], 'NumberOfUserReferences' : [ 0x1c, ['unsigned long']], - 'u' : [ 0x20, ['__unnamed_1248']], + 'u' : [ 0x20, ['__unnamed_123f']], 'FilePointer' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], 'WaitingForDeletion' : [ 0x28, ['pointer', ['_EVENT_COUNTER']]], 'ModifiedWriteCount' : [ 0x2c, ['unsigned short']], @@ -1324,19 +1309,19 @@ nt_types = { 'CompletionContext' : [ 0x6c, ['pointer', ['_IO_COMPLETION_CONTEXT']]], } ], '_MMPTE_HARDWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Writable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_COMPLETION_CONTEXT' : [ 0x8, { 'Port' : [ 0x0, ['pointer', ['void']]], @@ -1362,37 +1347,37 @@ nt_types = { 'OldIrql' : [ 0x8, ['unsigned char']], } ], '_MMSECTION_FLAGS' : [ 0x4, { - 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19)]], - 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'HadUserReference' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'filler' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 32)]], + 'BeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingCreated' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'BeingPurged' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'NoModifiedWriting' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'FailAllIo' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Image' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Based' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'File' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Networked' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'NoCache' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'PhysicalMemory' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'Reserve' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'Commit' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'FloppyMedia' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'WasPurged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'UserReference' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'GlobalMemory' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'DeleteOnClose' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 19, native_type='unsigned long')]], + 'FilePointerNull' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'DebugSymbolsLoaded' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'SetMappedFileIoComplete' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'CollidedFlush' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'HadUserReference' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'ImageMappedInSystemSpace' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'UserWritable' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'GlobalOnlyPerSession' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'filler' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 32, native_type='unsigned long')]], } ], '_DEFERRED_WRITE' : [ 0x28, { 'NodeTypeCode' : [ 0x0, ['short']], @@ -1435,14 +1420,14 @@ nt_types = { 'EffectiveOnly' : [ 0x5, ['unsigned char']], 'ImpersonationLevel' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {0: 'SecurityAnonymous', 1: 'SecurityIdentification', 2: 'SecurityImpersonation', 3: 'SecurityDelegation'})]], } ], - '__unnamed_12f2' : [ 0x4, { + '__unnamed_12ed' : [ 0x4, { 'LegacyDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], 'PendingDeviceRelations' : [ 0x0, ['pointer', ['_DEVICE_RELATIONS']]], } ], - '__unnamed_12f4' : [ 0x4, { + '__unnamed_12ef' : [ 0x4, { 'NextResourceDeviceNode' : [ 0x0, ['pointer', ['_DEVICE_NODE']]], } ], - '__unnamed_12f8' : [ 0x10, { + '__unnamed_12f3' : [ 0x10, { 'DockStatus' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DOCK_NOTDOCKDEVICE', 1: 'DOCK_QUIESCENT', 2: 'DOCK_ARRIVING', 3: 'DOCK_DEPARTING', 4: 'DOCK_EJECTIRP_COMPLETED'})]], 'ListEntry' : [ 0x4, ['_LIST_ENTRY']], 'SerialNumber' : [ 0xc, ['pointer', ['unsigned short']]], @@ -1484,22 +1469,22 @@ nt_types = { 'QueryTranslatorMask' : [ 0xda, ['unsigned short']], 'NoArbiterMask' : [ 0xdc, ['unsigned short']], 'QueryArbiterMask' : [ 0xde, ['unsigned short']], - 'OverUsed1' : [ 0xe0, ['__unnamed_12f2']], - 'OverUsed2' : [ 0xe4, ['__unnamed_12f4']], + 'OverUsed1' : [ 0xe0, ['__unnamed_12ed']], + 'OverUsed2' : [ 0xe4, ['__unnamed_12ef']], 'BootResources' : [ 0xe8, ['pointer', ['_CM_RESOURCE_LIST']]], 'CapabilityFlags' : [ 0xec, ['unsigned long']], - 'DockInfo' : [ 0xf0, ['__unnamed_12f8']], + 'DockInfo' : [ 0xf0, ['__unnamed_12f3']], 'DisableableDepends' : [ 0x100, ['unsigned long']], 'PendedSetInterfaceState' : [ 0x104, ['_LIST_ENTRY']], 'LegacyBusListEntry' : [ 0x10c, ['_LIST_ENTRY']], 'DriverUnloadRetryCount' : [ 0x114, ['unsigned long']], } ], - '__unnamed_12fd' : [ 0x38, { + '__unnamed_12f8' : [ 0x38, { 'CriticalSection' : [ 0x0, ['_RTL_CRITICAL_SECTION']], 'Resource' : [ 0x0, ['_ERESOURCE']], } ], '_HEAP_LOCK' : [ 0x38, { - 'Lock' : [ 0x0, ['__unnamed_12fd']], + 'Lock' : [ 0x0, ['__unnamed_12f8']], } ], '_KPCR' : [ 0xd70, { 'NtTib' : [ 0x0, ['_NT_TIB']], @@ -1549,50 +1534,50 @@ nt_types = { 'BasePage' : [ 0x0, ['unsigned long']], 'PageCount' : [ 0x4, ['unsigned long']], } ], - '__unnamed_131c' : [ 0x4, { + '__unnamed_1317' : [ 0x4, { 'Flink' : [ 0x0, ['unsigned long']], 'WsIndex' : [ 0x0, ['unsigned long']], 'Event' : [ 0x0, ['pointer', ['_KEVENT']]], 'ReadStatus' : [ 0x0, ['long']], 'NextStackPfn' : [ 0x0, ['_SINGLE_LIST_ENTRY']], } ], - '__unnamed_131e' : [ 0x4, { + '__unnamed_1319' : [ 0x4, { 'Blink' : [ 0x0, ['unsigned long']], 'ShareCount' : [ 0x0, ['unsigned long']], } ], - '__unnamed_1321' : [ 0x4, { + '__unnamed_131c' : [ 0x4, { 'ShortFlags' : [ 0x0, ['unsigned short']], 'ReferenceCount' : [ 0x2, ['unsigned short']], } ], - '__unnamed_1323' : [ 0x4, { + '__unnamed_131e' : [ 0x4, { 'e1' : [ 0x0, ['_MMPFNENTRY']], - 'e2' : [ 0x0, ['__unnamed_1321']], + 'e2' : [ 0x0, ['__unnamed_131c']], } ], - '__unnamed_132a' : [ 0x4, { + '__unnamed_1325' : [ 0x4, { 'EntireFrame' : [ 0x0, ['unsigned long']], - 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 26)]], - 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'LockCharged' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'KernelStack' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'PteFrame' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 26, native_type='unsigned long')]], + 'InPageError' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'VerifierAllocation' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'AweAllocation' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'LockCharged' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'KernelStack' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_MMPFN' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_131c']], + 'u1' : [ 0x0, ['__unnamed_1317']], 'PteAddress' : [ 0x4, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x8, ['__unnamed_131e']], - 'u3' : [ 0xc, ['__unnamed_1323']], + 'u2' : [ 0x8, ['__unnamed_1319']], + 'u3' : [ 0xc, ['__unnamed_131e']], 'OriginalPte' : [ 0x10, ['_MMPTE']], - 'u4' : [ 0x14, ['__unnamed_132a']], + 'u4' : [ 0x14, ['__unnamed_1325']], } ], - '__unnamed_1330' : [ 0x4, { + '__unnamed_132b' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'Flags' : [ 0x0, ['_MM_SESSION_SPACE_FLAGS']], } ], '_MM_SESSION_SPACE' : [ 0x1278, { 'ReferenceCount' : [ 0x0, ['unsigned long']], - 'u' : [ 0x4, ['__unnamed_1330']], + 'u' : [ 0x4, ['__unnamed_132b']], 'SessionId' : [ 0x8, ['unsigned long']], 'SessionPageDirectoryIndex' : [ 0xc, ['unsigned long']], 'GlobalVirtualAddress' : [ 0x10, ['pointer', ['_MM_SESSION_SPACE']]], @@ -1726,12 +1711,12 @@ nt_types = { 'Unused' : [ 0x0, ['unsigned long']], } ], '_MMPTE_SOFTWARE' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'PageFileLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFileHigh' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_IO_RESOURCE_REQUIREMENTS_LIST' : [ 0x48, { 'ListSize' : [ 0x0, ['unsigned long']], @@ -1761,13 +1746,13 @@ nt_types = { 'Peak' : [ 0x8, ['unsigned long']], 'Return' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1368' : [ 0x50, { + '__unnamed_1362' : [ 0x50, { 'CellData' : [ 0x0, ['_CELL_DATA']], 'List' : [ 0x0, ['array', 1, ['unsigned long']]], } ], '_CM_CACHED_VALUE_INDEX' : [ 0x54, { 'CellIndex' : [ 0x0, ['unsigned long']], - 'Data' : [ 0x4, ['__unnamed_1368']], + 'Data' : [ 0x4, ['__unnamed_1362']], } ], '_WMI_BUFFER_HEADER' : [ 0x48, { 'Wnode' : [ 0x0, ['_WNODE_HEADER']], @@ -1849,18 +1834,18 @@ nt_types = { 'DataValueHigh' : [ 0x8, ['unsigned long']], } ], '_MMPFNENTRY' : [ 0x4, { - 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 7)]], - 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11)]], - 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14)]], - 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'LockCharged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'Modified' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'ReadInProgress' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WriteInProgress' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'PrototypePte' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'PageColor' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 7, native_type='unsigned long')]], + 'ParityError' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'PageLocation' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 11, native_type='unsigned long')]], + 'RemovalRequested' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'CacheAttribute' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 14, native_type='unsigned long')]], + 'Rom' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'LockCharged' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], } ], '_IO_COUNTERS' : [ 0x30, { 'ReadOperationCount' : [ 0x0, ['unsigned long long']], @@ -1933,15 +1918,15 @@ nt_types = { 'Volume' : [ 0x44, ['_LIST_ENTRY']], } ], '_MMSUPPORT_FLAGS' : [ 0x4, { - 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'WorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'AddressSpaceBeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16)]], - 'AllowWorkingSetAdjustment' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24)]], - 'MemoryPriority' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'SessionSpace' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'BeingTrimmed' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SessionLeader' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'TrimHard' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'WorkingSetHard' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'AddressSpaceBeingDeleted' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 16, native_type='unsigned long')]], + 'AllowWorkingSetAdjustment' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 24, native_type='unsigned long')]], + 'MemoryPriority' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], '_TERMINATION_PORT' : [ 0x8, { 'Next' : [ 0x0, ['pointer', ['_TERMINATION_PORT']]], @@ -2004,8 +1989,8 @@ nt_types = { 'Revision' : [ 0x0, ['unsigned long']], 'DynamicThrottle' : [ 0x4, ['unsigned char']], 'Spare' : [ 0x5, ['array', 3, ['unsigned char']]], - 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32)]], + 'DisableCStates' : [ 0x8, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Reserved' : [ 0x8, ['BitField', dict(start_bit = 1, end_bit = 32, native_type='unsigned long')]], 'PolicyCount' : [ 0xc, ['unsigned long']], 'Policy' : [ 0x10, ['array', 3, ['_PROCESSOR_POWER_POLICY_INFO']]], } ], @@ -2060,10 +2045,10 @@ nt_types = { 'RegisterArea' : [ 0x1c, ['array', 80, ['unsigned char']]], } ], 'EX_QUEUE_WORKER_INFO' : [ 0x4, { - 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'QueueDisabled' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'MakeThreadsAsNecessary' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'WaitMode' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WorkerCount' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], 'QueueWorkerInfo' : [ 0x0, ['long']], } ], 'SYSTEM_POWER_LEVEL' : [ 0x18, { @@ -2112,12 +2097,12 @@ nt_types = { 'GpValue' : [ 0x34, ['unsigned long']], } ], '_MMPTE_LIST' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OneEntry' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'filler0' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'filler1' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'NextEntry' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_CMHIVE' : [ 0x49c, { 'Hive' : [ 0x0, ['_HHIVE']], @@ -2196,11 +2181,11 @@ nt_types = { 'Name' : [ 0xc, ['array', 1, ['unsigned short']]], } ], '_MM_SESSION_SPACE_FLAGS' : [ 0x4, { - 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Filler0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 4)]], - 'HasWsLock' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Filler' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32)]], + 'Initialized' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Filler0' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 4, native_type='unsigned long')]], + 'HasWsLock' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DeletePending' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Filler' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 32, native_type='unsigned long')]], } ], '_CM_PARTIAL_RESOURCE_LIST' : [ 0x18, { 'Version' : [ 0x0, ['unsigned short']], @@ -2226,10 +2211,10 @@ nt_types = { 'MajorFunction' : [ 0x38, ['array', 28, ['pointer', ['void']]]], } ], '_WMI_BUFFER_STATE' : [ 0x4, { - 'Free' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'InUse' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Flush' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Unused' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32)]], + 'Free' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'InUse' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Flush' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Unused' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 32, native_type='unsigned long')]], } ], '_MMFREE_POOL_ENTRY' : [ 0x14, { 'List' : [ 0x0, ['_LIST_ENTRY']], @@ -2237,7 +2222,7 @@ nt_types = { 'Signature' : [ 0xc, ['unsigned long']], 'Owner' : [ 0x10, ['pointer', ['_MMFREE_POOL_ENTRY']]], } ], - '__unnamed_1441' : [ 0x28, { + '__unnamed_143b' : [ 0x28, { 'ListEntry' : [ 0x0, ['_LIST_ENTRY']], 'Wcb' : [ 0x0, ['_WAIT_CONTEXT_BLOCK']], } ], @@ -2256,7 +2241,7 @@ nt_types = { 'DeviceExtension' : [ 0x28, ['pointer', ['void']]], 'DeviceType' : [ 0x2c, ['unsigned long']], 'StackSize' : [ 0x30, ['unsigned char']], - 'Queue' : [ 0x34, ['__unnamed_1441']], + 'Queue' : [ 0x34, ['__unnamed_143b']], 'AlignmentRequirement' : [ 0x5c, ['unsigned long']], 'DeviceQueue' : [ 0x60, ['_KDEVICE_QUEUE']], 'Dpc' : [ 0x74, ['_KDPC']], @@ -2374,13 +2359,13 @@ nt_types = { 'QueryNameProcedure' : [ 0x44, ['pointer', ['void']]], 'OkayToCloseProcedure' : [ 0x48, ['pointer', ['void']]], } ], - '__unnamed_1487' : [ 0x4, { + '__unnamed_1481' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'SubsectionFlags' : [ 0x0, ['_MMSUBSECTION_FLAGS']], } ], '_SUBSECTION' : [ 0x20, { 'ControlArea' : [ 0x0, ['pointer', ['_CONTROL_AREA']]], - 'u' : [ 0x4, ['__unnamed_1487']], + 'u' : [ 0x4, ['__unnamed_1481']], 'StartingSector' : [ 0x8, ['unsigned long']], 'NumberOfFullSectors' : [ 0xc, ['unsigned long']], 'SubsectionBase' : [ 0x10, ['pointer', ['_MMPTE']]], @@ -2389,19 +2374,19 @@ nt_types = { 'NextSubsection' : [ 0x1c, ['pointer', ['_SUBSECTION']]], } ], '_WMI_LOGGER_MODE' : [ 0x4, { - 'SequentialFile' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'CircularFile' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'AppendFile' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'RealTime' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'DelayOpenFile' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'BufferOnly' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'PrivateLogger' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'AddHeader' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'UseExisting' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'UseGlobalSequence' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'UseLocalSequence' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'Unused2' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'SequentialFile' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'CircularFile' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'AppendFile' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Unused1' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'RealTime' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'DelayOpenFile' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'BufferOnly' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'PrivateLogger' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'AddHeader' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'UseExisting' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'UseGlobalSequence' : [ 0x0, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'UseLocalSequence' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'Unused2' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], } ], '_NT_TIB' : [ 0x1c, { 'ExceptionList' : [ 0x0, ['pointer', ['_EXCEPTION_REGISTRATION_RECORD']]], @@ -2413,19 +2398,19 @@ nt_types = { 'ArbitraryUserPointer' : [ 0x14, ['pointer', ['void']]], 'Self' : [ 0x18, ['pointer', ['_NT_TIB']]], } ], - '__unnamed_1498' : [ 0x4, { + '__unnamed_1492' : [ 0x4, { 'LongFlags' : [ 0x0, ['unsigned long']], 'VadFlags' : [ 0x0, ['_MMVAD_FLAGS']], } ], - '__unnamed_149b' : [ 0x4, { + '__unnamed_1495' : [ 0x4, { 'LongFlags2' : [ 0x0, ['unsigned long']], 'VadFlags2' : [ 0x0, ['_MMVAD_FLAGS2']], } ], - '__unnamed_149e' : [ 0x8, { + '__unnamed_1498' : [ 0x8, { 'List' : [ 0x0, ['_LIST_ENTRY']], 'Secured' : [ 0x0, ['_MMADDRESS_LIST']], } ], - '__unnamed_14a4' : [ 0x4, { + '__unnamed_149e' : [ 0x4, { 'Banked' : [ 0x0, ['pointer', ['_MMBANKED_SECTION']]], 'ExtendedInfo' : [ 0x0, ['pointer', ['_MMEXTEND_INFO']]], } ], @@ -2435,25 +2420,25 @@ nt_types = { 'Parent' : [ 0x8, ['pointer', ['_MMVAD']]], 'LeftChild' : [ 0xc, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x10, ['pointer', ['_MMVAD']]], - 'u' : [ 0x14, ['__unnamed_1498']], + 'u' : [ 0x14, ['__unnamed_1492']], 'ControlArea' : [ 0x18, ['pointer', ['_CONTROL_AREA']]], 'FirstPrototypePte' : [ 0x1c, ['pointer', ['_MMPTE']]], 'LastContiguousPte' : [ 0x20, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x24, ['__unnamed_149b']], - 'u3' : [ 0x28, ['__unnamed_149e']], - 'u4' : [ 0x30, ['__unnamed_14a4']], + 'u2' : [ 0x24, ['__unnamed_1495']], + 'u3' : [ 0x28, ['__unnamed_1498']], + 'u4' : [ 0x30, ['__unnamed_149e']], } ], '_MMVAD_FLAGS' : [ 0x4, { - 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19)]], - 'PhysicalMapping' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20)]], - 'ImageMap' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'UserPhysicalPages' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'WriteWatch' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29)]], - 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'CommitCharge' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 19, native_type='unsigned long')]], + 'PhysicalMapping' : [ 0x0, ['BitField', dict(start_bit = 19, end_bit = 20, native_type='unsigned long')]], + 'ImageMap' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'UserPhysicalPages' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'NoChange' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'WriteWatch' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 29, native_type='unsigned long')]], + 'LargePages' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'MemCommit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'PrivateMemory' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_POOL_DESCRIPTOR' : [ 0x1028, { 'PoolType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'NonPagedPool', 1: 'PagedPool', 2: 'NonPagedPoolMustSucceed', 3: 'DontUseThisType', 4: 'NonPagedPoolCacheAligned', 5: 'PagedPoolCacheAligned', 6: 'NonPagedPoolCacheAlignedMustS', 7: 'MaxPoolType', 34: 'NonPagedPoolMustSucceedSession', 35: 'DontUseThisTypeSession', 32: 'NonPagedPoolSession', 36: 'NonPagedPoolCacheAlignedSession', 33: 'PagedPoolSession', 38: 'NonPagedPoolCacheAlignedMustSSession', 37: 'PagedPoolCacheAlignedSession'})]], @@ -2467,6 +2452,21 @@ nt_types = { 'PendingFrees' : [ 0x20, ['pointer', ['void']]], 'PendingFreeDepth' : [ 0x24, ['long']], 'ListHeads' : [ 0x28, ['array', 512, ['_LIST_ENTRY']]], +} ], + '_HARDWARE_PTE' : [ 0x4, { + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Accessed' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'Dirty' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'LargePage' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'Global' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'reserved' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_PEB_LDR_DATA' : [ 0x28, { 'Length' : [ 0x0, ['unsigned long']], @@ -2559,12 +2559,12 @@ nt_types = { 'FaultingVa' : [ 0x4, ['pointer', ['void']]], } ], '_MMPTE_SUBSECTION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 31)]], - 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'SubsectionAddressLow' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'SubsectionAddressHigh' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 31, native_type='unsigned long')]], + 'WhichPool' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_VI_DEADLOCK_NODE' : [ 0x68, { 'Parent' : [ 0x0, ['pointer', ['_VI_DEADLOCK_NODE']]], @@ -2574,9 +2574,9 @@ nt_types = { 'FreeListEntry' : [ 0x14, ['_LIST_ENTRY']], 'Root' : [ 0x1c, ['pointer', ['_VI_DEADLOCK_RESOURCE']]], 'ThreadEntry' : [ 0x20, ['pointer', ['_VI_DEADLOCK_THREAD']]], - 'Active' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'OnlyTryAcquireUsed' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'SequenceNumber' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'Active' : [ 0x24, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'OnlyTryAcquireUsed' : [ 0x24, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'SequenceNumber' : [ 0x24, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], 'StackTrace' : [ 0x28, ['array', 8, ['pointer', ['void']]]], 'ParentStackTrace' : [ 0x48, ['array', 8, ['pointer', ['void']]]], } ], @@ -2732,18 +2732,18 @@ nt_types = { 'Sacl' : [ 0xc, ['pointer', ['_ACL']]], 'Dacl' : [ 0x10, ['pointer', ['_ACL']]], } ], - '__unnamed_1513' : [ 0x8, { + '__unnamed_150f' : [ 0x8, { 'UserData' : [ 0x0, ['pointer', ['void']]], 'Owner' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_1515' : [ 0x8, { + '__unnamed_1511' : [ 0x8, { 'ListHead' : [ 0x0, ['_LIST_ENTRY']], } ], '_RTLP_RANGE_LIST_ENTRY' : [ 0x28, { 'Start' : [ 0x0, ['unsigned long long']], 'End' : [ 0x8, ['unsigned long long']], - 'Allocated' : [ 0x10, ['__unnamed_1513']], - 'Merged' : [ 0x10, ['__unnamed_1515']], + 'Allocated' : [ 0x10, ['__unnamed_150f']], + 'Merged' : [ 0x10, ['__unnamed_1511']], 'Attributes' : [ 0x18, ['unsigned char']], 'PublicFlags' : [ 0x19, ['unsigned char']], 'PrivateFlags' : [ 0x1a, ['unsigned short']], @@ -2871,34 +2871,34 @@ nt_types = { 'V86Fs' : [ 0x84, ['unsigned long']], 'V86Gs' : [ 0x88, ['unsigned long']], } ], - '__unnamed_153e' : [ 0x4, { + '__unnamed_153a' : [ 0x4, { 'BaseMid' : [ 0x0, ['unsigned char']], 'Flags1' : [ 0x1, ['unsigned char']], 'Flags2' : [ 0x2, ['unsigned char']], 'BaseHi' : [ 0x3, ['unsigned char']], } ], - '__unnamed_1545' : [ 0x4, { - 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13)]], - 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15)]], - 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21)]], - 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22)]], - 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23)]], - 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24)]], - 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32)]], + '__unnamed_1541' : [ 0x4, { + 'BaseMid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'Type' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 13, native_type='unsigned long')]], + 'Dpl' : [ 0x0, ['BitField', dict(start_bit = 13, end_bit = 15, native_type='unsigned long')]], + 'Pres' : [ 0x0, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'LimitHi' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'Sys' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 21, native_type='unsigned long')]], + 'Reserved_0' : [ 0x0, ['BitField', dict(start_bit = 21, end_bit = 22, native_type='unsigned long')]], + 'Default_Big' : [ 0x0, ['BitField', dict(start_bit = 22, end_bit = 23, native_type='unsigned long')]], + 'Granularity' : [ 0x0, ['BitField', dict(start_bit = 23, end_bit = 24, native_type='unsigned long')]], + 'BaseHi' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], } ], - '__unnamed_1547' : [ 0x4, { - 'Bytes' : [ 0x0, ['__unnamed_153e']], - 'Bits' : [ 0x0, ['__unnamed_1545']], + '__unnamed_1543' : [ 0x4, { + 'Bytes' : [ 0x0, ['__unnamed_153a']], + 'Bits' : [ 0x0, ['__unnamed_1541']], } ], '_KGDTENTRY' : [ 0x8, { 'LimitLow' : [ 0x0, ['unsigned short']], 'BaseLow' : [ 0x2, ['unsigned short']], - 'HighWord' : [ 0x4, ['__unnamed_1547']], + 'HighWord' : [ 0x4, ['__unnamed_1543']], } ], - '__unnamed_1551' : [ 0x5, { + '__unnamed_154d' : [ 0x5, { 'Acquired' : [ 0x0, ['unsigned char']], 'CacheLineSize' : [ 0x1, ['unsigned char']], 'LatencyTimer' : [ 0x2, ['unsigned char']], @@ -2935,51 +2935,51 @@ nt_types = { 'ChildWaitWakeCount' : [ 0xa4, ['unsigned long']], 'PreservedConfig' : [ 0xa8, ['pointer', ['_PCI_COMMON_CONFIG']]], 'Lock' : [ 0xac, ['_PCI_LOCK']], - 'HotPlugParameters' : [ 0xb4, ['__unnamed_1551']], + 'HotPlugParameters' : [ 0xb4, ['__unnamed_154d']], 'BusHackFlags' : [ 0xbc, ['unsigned long']], } ], - '__unnamed_1555' : [ 0xc, { + '__unnamed_1551' : [ 0xc, { 'Start' : [ 0x0, ['_LARGE_INTEGER']], 'Length' : [ 0x8, ['unsigned long']], } ], - '__unnamed_1557' : [ 0xc, { + '__unnamed_1553' : [ 0xc, { 'Level' : [ 0x0, ['unsigned long']], 'Vector' : [ 0x4, ['unsigned long']], 'Affinity' : [ 0x8, ['unsigned long']], } ], - '__unnamed_1559' : [ 0xc, { + '__unnamed_1555' : [ 0xc, { 'Channel' : [ 0x0, ['unsigned long']], 'Port' : [ 0x4, ['unsigned long']], 'Reserved1' : [ 0x8, ['unsigned long']], } ], - '__unnamed_155b' : [ 0xc, { + '__unnamed_1557' : [ 0xc, { 'Data' : [ 0x0, ['array', 3, ['unsigned long']]], } ], - '__unnamed_155d' : [ 0xc, { + '__unnamed_1559' : [ 0xc, { 'Start' : [ 0x0, ['unsigned long']], 'Length' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned long']], } ], - '__unnamed_155f' : [ 0xc, { + '__unnamed_155b' : [ 0xc, { 'DataSize' : [ 0x0, ['unsigned long']], 'Reserved1' : [ 0x4, ['unsigned long']], 'Reserved2' : [ 0x8, ['unsigned long']], } ], - '__unnamed_1561' : [ 0xc, { - 'Generic' : [ 0x0, ['__unnamed_1555']], - 'Port' : [ 0x0, ['__unnamed_1555']], - 'Interrupt' : [ 0x0, ['__unnamed_1557']], - 'Memory' : [ 0x0, ['__unnamed_1555']], - 'Dma' : [ 0x0, ['__unnamed_1559']], - 'DevicePrivate' : [ 0x0, ['__unnamed_155b']], - 'BusNumber' : [ 0x0, ['__unnamed_155d']], - 'DeviceSpecificData' : [ 0x0, ['__unnamed_155f']], + '__unnamed_155d' : [ 0xc, { + 'Generic' : [ 0x0, ['__unnamed_1551']], + 'Port' : [ 0x0, ['__unnamed_1551']], + 'Interrupt' : [ 0x0, ['__unnamed_1553']], + 'Memory' : [ 0x0, ['__unnamed_1551']], + 'Dma' : [ 0x0, ['__unnamed_1555']], + 'DevicePrivate' : [ 0x0, ['__unnamed_1557']], + 'BusNumber' : [ 0x0, ['__unnamed_1559']], + 'DeviceSpecificData' : [ 0x0, ['__unnamed_155b']], } ], '_CM_PARTIAL_RESOURCE_DESCRIPTOR' : [ 0x10, { 'Type' : [ 0x0, ['unsigned char']], 'ShareDisposition' : [ 0x1, ['unsigned char']], 'Flags' : [ 0x2, ['unsigned short']], - 'u' : [ 0x4, ['__unnamed_1561']], + 'u' : [ 0x4, ['__unnamed_155d']], } ], '_SYSPTES_HEADER' : [ 0xc, { 'ListHead' : [ 0x0, ['_LIST_ENTRY']], @@ -2996,11 +2996,11 @@ nt_types = { } ], '_CM_KEY_CONTROL_BLOCK' : [ 0x50, { 'RefCount' : [ 0x0, ['unsigned long']], - 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8)]], - 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22)]], - 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32)]], + 'ExtFlags' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 8, native_type='unsigned long')]], + 'PrivateAlloc' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Delete' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'DelayedCloseIndex' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 22, native_type='unsigned long')]], + 'TotalLevels' : [ 0x4, ['BitField', dict(start_bit = 22, end_bit = 32, native_type='unsigned long')]], 'KeyHash' : [ 0x8, ['_CM_KEY_HASH']], 'ConvKey' : [ 0x8, ['unsigned long']], 'NextHash' : [ 0xc, ['pointer', ['_CM_KEY_HASH']]], @@ -3019,10 +3019,10 @@ nt_types = { 'KcbMaxNameLen' : [ 0x40, ['unsigned short']], 'KcbMaxValueNameLen' : [ 0x42, ['unsigned short']], 'KcbMaxValueDataLen' : [ 0x44, ['unsigned long']], - 'KcbUserFlags' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'KcbVirtControlFlags' : [ 0x48, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'KcbDebug' : [ 0x48, ['BitField', dict(start_bit = 8, end_bit = 16)]], - 'Flags' : [ 0x48, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'KcbUserFlags' : [ 0x48, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'KcbVirtControlFlags' : [ 0x48, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'KcbDebug' : [ 0x48, ['BitField', dict(start_bit = 8, end_bit = 16, native_type='unsigned long')]], + 'Flags' : [ 0x48, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], } ], '_KDPC' : [ 0x20, { 'Type' : [ 0x0, ['short']], @@ -3076,20 +3076,20 @@ nt_types = { 'KeyHive' : [ 0x8, ['pointer', ['_HHIVE']]], 'KeyCell' : [ 0xc, ['unsigned long']], } ], - '__unnamed_159f' : [ 0x4, { + '__unnamed_159b' : [ 0x4, { 'MasterIrp' : [ 0x0, ['pointer', ['_IRP']]], 'IrpCount' : [ 0x0, ['long']], 'SystemBuffer' : [ 0x0, ['pointer', ['void']]], } ], - '__unnamed_15a6' : [ 0x8, { + '__unnamed_15a2' : [ 0x8, { 'UserApcRoutine' : [ 0x0, ['pointer', ['void']]], 'UserApcContext' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_15a8' : [ 0x8, { - 'AsynchronousParameters' : [ 0x0, ['__unnamed_15a6']], + '__unnamed_15a4' : [ 0x8, { + 'AsynchronousParameters' : [ 0x0, ['__unnamed_15a2']], 'AllocationSize' : [ 0x0, ['_LARGE_INTEGER']], } ], - '__unnamed_15ad' : [ 0x28, { + '__unnamed_15a9' : [ 0x28, { 'DeviceQueueEntry' : [ 0x0, ['_KDEVICE_QUEUE_ENTRY']], 'DriverContext' : [ 0x0, ['array', 4, ['pointer', ['void']]]], 'Thread' : [ 0x10, ['pointer', ['_ETHREAD']]], @@ -3099,8 +3099,8 @@ nt_types = { 'PacketType' : [ 0x20, ['unsigned long']], 'OriginalFileObject' : [ 0x24, ['pointer', ['_FILE_OBJECT']]], } ], - '__unnamed_15af' : [ 0x30, { - 'Overlay' : [ 0x0, ['__unnamed_15ad']], + '__unnamed_15ab' : [ 0x30, { + 'Overlay' : [ 0x0, ['__unnamed_15a9']], 'Apc' : [ 0x0, ['_KAPC']], 'CompletionKey' : [ 0x0, ['pointer', ['void']]], } ], @@ -3109,7 +3109,7 @@ nt_types = { 'Size' : [ 0x2, ['unsigned short']], 'MdlAddress' : [ 0x4, ['pointer', ['_MDL']]], 'Flags' : [ 0x8, ['unsigned long']], - 'AssociatedIrp' : [ 0xc, ['__unnamed_159f']], + 'AssociatedIrp' : [ 0xc, ['__unnamed_159b']], 'ThreadListEntry' : [ 0x10, ['_LIST_ENTRY']], 'IoStatus' : [ 0x18, ['_IO_STATUS_BLOCK']], 'RequestorMode' : [ 0x20, ['unsigned char']], @@ -3122,10 +3122,10 @@ nt_types = { 'AllocationFlags' : [ 0x27, ['unsigned char']], 'UserIosb' : [ 0x28, ['pointer', ['_IO_STATUS_BLOCK']]], 'UserEvent' : [ 0x2c, ['pointer', ['_KEVENT']]], - 'Overlay' : [ 0x30, ['__unnamed_15a8']], + 'Overlay' : [ 0x30, ['__unnamed_15a4']], 'CancelRoutine' : [ 0x38, ['pointer', ['void']]], 'UserBuffer' : [ 0x3c, ['pointer', ['void']]], - 'Tail' : [ 0x40, ['__unnamed_15af']], + 'Tail' : [ 0x40, ['__unnamed_15ab']], } ], '_PCI_LOCK' : [ 0x8, { 'Atom' : [ 0x0, ['unsigned long']], @@ -3135,13 +3135,13 @@ nt_types = { 'Cell' : [ 0x0, ['unsigned long']], 'CachedSecurity' : [ 0x4, ['pointer', ['_CM_KEY_SECURITY_CACHE']]], } ], - '__unnamed_15b8' : [ 0x4, { + '__unnamed_15b4' : [ 0x4, { 'PhysicalAddress' : [ 0x0, ['unsigned long']], 'VirtualSize' : [ 0x0, ['unsigned long']], } ], '_IMAGE_SECTION_HEADER' : [ 0x28, { 'Name' : [ 0x0, ['array', 8, ['unsigned char']]], - 'Misc' : [ 0x8, ['__unnamed_15b8']], + 'Misc' : [ 0x8, ['__unnamed_15b4']], 'VirtualAddress' : [ 0xc, ['unsigned long']], 'SizeOfRawData' : [ 0x10, ['unsigned long']], 'PointerToRawData' : [ 0x14, ['unsigned long']], @@ -3151,14 +3151,14 @@ nt_types = { 'NumberOfLinenumbers' : [ 0x22, ['unsigned short']], 'Characteristics' : [ 0x24, ['unsigned long']], } ], - '__unnamed_15be' : [ 0x4, { + '__unnamed_15ba' : [ 0x4, { 'Level' : [ 0x0, ['unsigned long']], } ], '_POP_ACTION_TRIGGER' : [ 0xc, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PolicyDeviceSystemButton', 1: 'PolicyDeviceThermalZone', 2: 'PolicyDeviceBattery', 3: 'PolicyInitiatePowerActionAPI', 4: 'PolicySetPowerStateAPI', 5: 'PolicyImmediateDozeS4', 6: 'PolicySystemIdle'})]], 'Flags' : [ 0x4, ['unsigned char']], 'Spare' : [ 0x5, ['array', 3, ['unsigned char']]], - 'Battery' : [ 0x8, ['__unnamed_15be']], + 'Battery' : [ 0x8, ['__unnamed_15ba']], 'Wait' : [ 0x8, ['pointer', ['_POP_TRIGGER_WAIT']]], } ], '_FAST_IO_DISPATCH' : [ 0x70, { @@ -3211,23 +3211,23 @@ nt_types = { 'NewCell' : [ 0x4, ['unsigned long']], } ], '_PCI_PMC' : [ 0x2, { - 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3)]], - 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'Version' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 3, native_type='unsigned char')]], + 'PMEClock' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'Rsvd1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'DeviceSpecificInitialization' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], 'Support' : [ 0x1, ['_PM_SUPPORT']], } ], '_DBGKD_CONTINUE' : [ 0x4, { 'ContinueStatus' : [ 0x0, ['long']], } ], - '__unnamed_1621' : [ 0x4, { + '__unnamed_161d' : [ 0x4, { 'VirtualAddress' : [ 0x0, ['pointer', ['void']]], 'Long' : [ 0x0, ['unsigned long']], 'e1' : [ 0x0, ['_MMWSLENTRY']], } ], '_MMWSLE' : [ 0x4, { - 'u1' : [ 0x0, ['__unnamed_1621']], + 'u1' : [ 0x0, ['__unnamed_161d']], } ], '_EXCEPTION_POINTERS' : [ 0x8, { 'ExceptionRecord' : [ 0x0, ['pointer', ['_EXCEPTION_RECORD']]], @@ -3297,8 +3297,8 @@ nt_types = { } ], '_VI_DEADLOCK_RESOURCE' : [ 0x80, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'VfDeadlockUnknown', 1: 'VfDeadlockMutex', 2: 'VfDeadlockFastMutex', 3: 'VfDeadlockFastMutexUnsafe', 4: 'VfDeadlockSpinLock', 5: 'VfDeadlockQueuedSpinLock', 6: 'VfDeadlockTypeMaximum'})]], - 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32)]], + 'NodeCount' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'RecursionCount' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 32, native_type='unsigned long')]], 'ResourceAddress' : [ 0x8, ['pointer', ['void']]], 'ThreadOwner' : [ 0xc, ['pointer', ['_VI_DEADLOCK_THREAD']]], 'ResourceList' : [ 0x10, ['_LIST_ENTRY']], @@ -3334,23 +3334,23 @@ nt_types = { 'Flink' : [ 0x8, ['unsigned long']], 'Blink' : [ 0xc, ['unsigned long']], } ], - '__unnamed_164c' : [ 0x4, { + '__unnamed_1649' : [ 0x4, { 'Spare' : [ 0x0, ['array', 4, ['unsigned char']]], } ], - '__unnamed_164e' : [ 0x4, { + '__unnamed_164b' : [ 0x4, { 'PrimaryBus' : [ 0x0, ['unsigned char']], 'SecondaryBus' : [ 0x1, ['unsigned char']], 'SubordinateBus' : [ 0x2, ['unsigned char']], - 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5)]], + 'SubtractiveDecode' : [ 0x3, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'IsaBitSet' : [ 0x3, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'VgaBitSet' : [ 0x3, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'WeChangedBusNumbers' : [ 0x3, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'IsaBitRequired' : [ 0x3, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], } ], 'PCI_HEADER_TYPE_DEPENDENT' : [ 0x4, { - 'type0' : [ 0x0, ['__unnamed_164c']], - 'type1' : [ 0x0, ['__unnamed_164e']], - 'type2' : [ 0x0, ['__unnamed_164e']], + 'type0' : [ 0x0, ['__unnamed_1649']], + 'type1' : [ 0x0, ['__unnamed_164b']], + 'type2' : [ 0x0, ['__unnamed_164b']], } ], '_DBGKD_GET_SET_BUS_DATA' : [ 0x14, { 'BusDataType' : [ 0x0, ['unsigned long']], @@ -3479,14 +3479,14 @@ nt_types = { 'Align16Byte' : [ 0x200, ['array', 8, ['unsigned char']]], } ], '_MMWSLENTRY' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8)]], - 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12)]], - 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'LockedInWs' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockedInMemory' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 8, native_type='unsigned long')]], + 'Hashed' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'Direct' : [ 0x0, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'Age' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 12, native_type='unsigned long')]], + 'VirtualPageNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_OBJECT_DIRECTORY' : [ 0xa4, { 'HashBuckets' : [ 0x0, ['array', 37, ['pointer', ['_OBJECT_DIRECTORY_ENTRY']]]], @@ -3595,11 +3595,11 @@ nt_types = { 'NumberParameters' : [ 0x10, ['unsigned long']], 'ExceptionInformation' : [ 0x14, ['array', 15, ['unsigned long']]], } ], - '__unnamed_16c7' : [ 0x4, { + '__unnamed_16c4' : [ 0x4, { 'ImageCommitment' : [ 0x0, ['unsigned long']], 'CreatingProcess' : [ 0x0, ['pointer', ['_EPROCESS']]], } ], - '__unnamed_16cb' : [ 0x4, { + '__unnamed_16c8' : [ 0x4, { 'ImageInformation' : [ 0x0, ['pointer', ['_SECTION_IMAGE_INFORMATION']]], 'FirstMappedVa' : [ 0x0, ['pointer', ['void']]], } ], @@ -3614,8 +3614,8 @@ nt_types = { 'ExtendInfo' : [ 0x20, ['pointer', ['_MMEXTEND_INFO']]], 'SystemImageBase' : [ 0x24, ['pointer', ['void']]], 'BasedAddress' : [ 0x28, ['pointer', ['void']]], - 'u1' : [ 0x2c, ['__unnamed_16c7']], - 'u2' : [ 0x30, ['__unnamed_16cb']], + 'u1' : [ 0x2c, ['__unnamed_16c4']], + 'u2' : [ 0x30, ['__unnamed_16c8']], 'PrototypePte' : [ 0x34, ['pointer', ['_MMPTE']]], 'ThePtes' : [ 0x38, ['array', 1, ['_MMPTE']]], } ], @@ -3849,7 +3849,7 @@ nt_types = { 'ExtensionType' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1768116272: 'PciPdoExtensionType', 1768116273: 'PciFdoExtensionType', 1768116274: 'PciArb_Io', 1768116275: 'PciArb_Memory', 1768116276: 'PciArb_Interrupt', 1768116277: 'PciArb_BusNumber', 1768116278: 'PciTrans_Interrupt', 1768116279: 'PciInterface_BusHandler', 1768116280: 'PciInterface_IntRouteHandler', 1768116281: 'PciInterface_PciCb', 1768116282: 'PciInterface_LegacyDeviceDetection', 1768116283: 'PciInterface_PmeHandler', 1768116284: 'PciInterface_DevicePresent', 1768116285: 'PciInterface_NativeIde', 1768116286: 'PciInterface_AgpTarget'})]], 'Destructor' : [ 0x8, ['pointer', ['void']]], } ], - '__unnamed_1712' : [ 0x30, { + '__unnamed_170f' : [ 0x30, { 'type0' : [ 0x0, ['_PCI_HEADER_TYPE_0']], 'type1' : [ 0x0, ['_PCI_HEADER_TYPE_1']], 'type2' : [ 0x0, ['_PCI_HEADER_TYPE_2']], @@ -3867,7 +3867,7 @@ nt_types = { 'LatencyTimer' : [ 0xd, ['unsigned char']], 'HeaderType' : [ 0xe, ['unsigned char']], 'BIST' : [ 0xf, ['unsigned char']], - 'u' : [ 0x10, ['__unnamed_1712']], + 'u' : [ 0x10, ['__unnamed_170f']], 'DeviceSpecific' : [ 0x40, ['array', 192, ['unsigned char']]], } ], '_HEAP_FREE_ENTRY_EXTRA' : [ 0x4, { @@ -4002,20 +4002,20 @@ nt_types = { 'Parent' : [ 0x8, ['pointer', ['_MMVAD']]], 'LeftChild' : [ 0xc, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x10, ['pointer', ['_MMVAD']]], - 'u' : [ 0x14, ['__unnamed_1498']], + 'u' : [ 0x14, ['__unnamed_1492']], 'ControlArea' : [ 0x18, ['pointer', ['_CONTROL_AREA']]], 'FirstPrototypePte' : [ 0x1c, ['pointer', ['_MMPTE']]], 'LastContiguousPte' : [ 0x20, ['pointer', ['_MMPTE']]], - 'u2' : [ 0x24, ['__unnamed_149b']], + 'u2' : [ 0x24, ['__unnamed_1495']], } ], - '__unnamed_1746' : [ 0x8, { + '__unnamed_1743' : [ 0x8, { 'IoStatus' : [ 0x0, ['_IO_STATUS_BLOCK']], 'LastByte' : [ 0x0, ['_LARGE_INTEGER']], } ], '_MMMOD_WRITER_MDL_ENTRY' : [ 0x58, { 'Links' : [ 0x0, ['_LIST_ENTRY']], 'WriteOffset' : [ 0x8, ['_LARGE_INTEGER']], - 'u' : [ 0x10, ['__unnamed_1746']], + 'u' : [ 0x10, ['__unnamed_1743']], 'Irp' : [ 0x18, ['pointer', ['_IRP']]], 'LastPageToWrite' : [ 0x1c, ['unsigned long']], 'PagingListHead' : [ 0x20, ['pointer', ['_MMMOD_WRITER_LISTHEAD']]], @@ -4065,9 +4065,9 @@ nt_types = { 'Parent' : [ 0x8, ['pointer', ['_MMVAD']]], 'LeftChild' : [ 0xc, ['pointer', ['_MMVAD']]], 'RightChild' : [ 0x10, ['pointer', ['_MMVAD']]], - 'u' : [ 0x14, ['__unnamed_1498']], + 'u' : [ 0x14, ['__unnamed_1492']], } ], - '__unnamed_1762' : [ 0x2c, { + '__unnamed_175f' : [ 0x2c, { 'InitialPrivilegeSet' : [ 0x0, ['_INITIAL_PRIVILEGE_SET']], 'PrivilegeSet' : [ 0x0, ['_PRIVILEGE_SET']], } ], @@ -4084,7 +4084,7 @@ nt_types = { 'SubjectSecurityContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], 'SecurityDescriptor' : [ 0x2c, ['pointer', ['void']]], 'AuxData' : [ 0x30, ['pointer', ['void']]], - 'Privileges' : [ 0x34, ['__unnamed_1762']], + 'Privileges' : [ 0x34, ['__unnamed_175f']], 'AuditPrivileges' : [ 0x60, ['unsigned char']], 'ObjectName' : [ 0x64, ['_UNICODE_STRING']], 'ObjectTypeName' : [ 0x6c, ['_UNICODE_STRING']], @@ -4100,10 +4100,10 @@ nt_types = { 'Data' : [ 0x20, ['_PLUGPLAY_EVENT_BLOCK']], } ], '_PRIVATE_CACHE_MAP_FLAGS' : [ 0x4, { - 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DontUse' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'ReadAheadActive' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'ReadAheadEnabled' : [ 0x0, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Available' : [ 0x0, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], } ], '_PNP_DEVICE_EVENT_LIST' : [ 0x4c, { 'Status' : [ 0x0, ['long']], @@ -4116,15 +4116,15 @@ nt_types = { 'SpecialRegisters' : [ 0x2cc, ['_KSPECIAL_REGISTERS']], } ], '_MMPTE_TRANSITION' : [ 0x4, { - 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10)]], - 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32)]], + 'Valid' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'Write' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Owner' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'WriteThrough' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'CacheDisable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'Protection' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 10, native_type='unsigned long')]], + 'Prototype' : [ 0x0, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'Transition' : [ 0x0, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'PageFrameNumber' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 32, native_type='unsigned long')]], } ], '_TOKEN_SOURCE' : [ 0x10, { 'SourceName' : [ 0x0, ['array', 8, ['unsigned char']]], @@ -4136,15 +4136,15 @@ nt_types = { 'Buffer' : [ 0x4, ['pointer', ['unsigned char']]], } ], '_MMVAD_FLAGS2' : [ 0x4, { - 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24)]], - 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25)]], - 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26)]], - 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27)]], - 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28)]], - 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29)]], - 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30)]], - 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'FileOffset' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 24, native_type='unsigned long')]], + 'SecNoChange' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 25, native_type='unsigned long')]], + 'OneSecured' : [ 0x0, ['BitField', dict(start_bit = 25, end_bit = 26, native_type='unsigned long')]], + 'MultipleSecured' : [ 0x0, ['BitField', dict(start_bit = 26, end_bit = 27, native_type='unsigned long')]], + 'ReadOnly' : [ 0x0, ['BitField', dict(start_bit = 27, end_bit = 28, native_type='unsigned long')]], + 'LongVad' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 29, native_type='unsigned long')]], + 'ExtendableFile' : [ 0x0, ['BitField', dict(start_bit = 29, end_bit = 30, native_type='unsigned long')]], + 'Inherit' : [ 0x0, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'CopyOnWrite' : [ 0x0, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], } ], '_flags' : [ 0x1, { 'Removable' : [ 0x0, ['unsigned char']], @@ -4163,9 +4163,9 @@ nt_types = { 'DemotePercent' : [ 0xc, ['unsigned char']], 'PromotePercent' : [ 0xd, ['unsigned char']], 'Spare' : [ 0xe, ['array', 2, ['unsigned char']]], - 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32)]], + 'AllowDemotion' : [ 0x10, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'AllowPromotion' : [ 0x10, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'Reserved' : [ 0x10, ['BitField', dict(start_bit = 2, end_bit = 32, native_type='unsigned long')]], } ], '_ARBITER_INSTANCE' : [ 0x9c, { 'Signature' : [ 0x0, ['unsigned long']], @@ -4360,47 +4360,47 @@ nt_types = { 'ModifiedId' : [ 0x10, ['_LUID']], 'TokenSource' : [ 0x18, ['_TOKEN_SOURCE']], } ], - '__unnamed_1806' : [ 0x10, { + '__unnamed_1803' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'FileAttributes' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'EaLength' : [ 0xc, ['unsigned long']], } ], - '__unnamed_180a' : [ 0x10, { + '__unnamed_1807' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'Parameters' : [ 0xc, ['pointer', ['_NAMED_PIPE_CREATE_PARAMETERS']]], } ], - '__unnamed_180e' : [ 0x10, { + '__unnamed_180b' : [ 0x10, { 'SecurityContext' : [ 0x0, ['pointer', ['_IO_SECURITY_CONTEXT']]], 'Options' : [ 0x4, ['unsigned long']], 'Reserved' : [ 0x8, ['unsigned short']], 'ShareAccess' : [ 0xa, ['unsigned short']], 'Parameters' : [ 0xc, ['pointer', ['_MAILSLOT_CREATE_PARAMETERS']]], } ], - '__unnamed_1810' : [ 0x10, { + '__unnamed_180d' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'Key' : [ 0x4, ['unsigned long']], 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], } ], - '__unnamed_1815' : [ 0x10, { + '__unnamed_1812' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'FileName' : [ 0x4, ['pointer', ['_STRING']]], 'FileInformationClass' : [ 0x8, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileMaximumInformation'})]], 'FileIndex' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1817' : [ 0x8, { + '__unnamed_1814' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'CompletionFilter' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1819' : [ 0x8, { + '__unnamed_1816' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileMaximumInformation'})]], } ], - '__unnamed_181b' : [ 0x10, { + '__unnamed_1818' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'FileInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileDirectoryInformation', 2: 'FileFullDirectoryInformation', 3: 'FileBothDirectoryInformation', 4: 'FileBasicInformation', 5: 'FileStandardInformation', 6: 'FileInternalInformation', 7: 'FileEaInformation', 8: 'FileAccessInformation', 9: 'FileNameInformation', 10: 'FileRenameInformation', 11: 'FileLinkInformation', 12: 'FileNamesInformation', 13: 'FileDispositionInformation', 14: 'FilePositionInformation', 15: 'FileFullEaInformation', 16: 'FileModeInformation', 17: 'FileAlignmentInformation', 18: 'FileAllInformation', 19: 'FileAllocationInformation', 20: 'FileEndOfFileInformation', 21: 'FileAlternateNameInformation', 22: 'FileStreamInformation', 23: 'FilePipeInformation', 24: 'FilePipeLocalInformation', 25: 'FilePipeRemoteInformation', 26: 'FileMailslotQueryInformation', 27: 'FileMailslotSetInformation', 28: 'FileCompressionInformation', 29: 'FileObjectIdInformation', 30: 'FileCompletionInformation', 31: 'FileMoveClusterInformation', 32: 'FileQuotaInformation', 33: 'FileReparsePointInformation', 34: 'FileNetworkOpenInformation', 35: 'FileAttributeTagInformation', 36: 'FileTrackingInformation', 37: 'FileIdBothDirectoryInformation', 38: 'FileIdFullDirectoryInformation', 39: 'FileValidDataLengthInformation', 40: 'FileShortNameInformation', 41: 'FileMaximumInformation'})]], 'FileObject' : [ 0x8, ['pointer', ['_FILE_OBJECT']]], @@ -4409,207 +4409,207 @@ nt_types = { 'ClusterCount' : [ 0xc, ['unsigned long']], 'DeleteHandle' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_181d' : [ 0x10, { + '__unnamed_181a' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'EaList' : [ 0x4, ['pointer', ['void']]], 'EaListLength' : [ 0x8, ['unsigned long']], 'EaIndex' : [ 0xc, ['unsigned long']], } ], - '__unnamed_181f' : [ 0x4, { + '__unnamed_181c' : [ 0x4, { 'Length' : [ 0x0, ['unsigned long']], } ], - '__unnamed_1823' : [ 0x8, { + '__unnamed_1820' : [ 0x8, { 'Length' : [ 0x0, ['unsigned long']], 'FsInformationClass' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {1: 'FileFsVolumeInformation', 2: 'FileFsLabelInformation', 3: 'FileFsSizeInformation', 4: 'FileFsDeviceInformation', 5: 'FileFsAttributeInformation', 6: 'FileFsControlInformation', 7: 'FileFsFullSizeInformation', 8: 'FileFsObjectIdInformation', 9: 'FileFsDriverPathInformation', 10: 'FileFsMaximumInformation'})]], } ], - '__unnamed_1825' : [ 0x10, { + '__unnamed_1822' : [ 0x10, { 'OutputBufferLength' : [ 0x0, ['unsigned long']], 'InputBufferLength' : [ 0x4, ['unsigned long']], 'FsControlCode' : [ 0x8, ['unsigned long']], 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1827' : [ 0x10, { + '__unnamed_1824' : [ 0x10, { 'Length' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], 'Key' : [ 0x4, ['unsigned long']], 'ByteOffset' : [ 0x8, ['_LARGE_INTEGER']], } ], - '__unnamed_1829' : [ 0x10, { + '__unnamed_1826' : [ 0x10, { 'OutputBufferLength' : [ 0x0, ['unsigned long']], 'InputBufferLength' : [ 0x4, ['unsigned long']], 'IoControlCode' : [ 0x8, ['unsigned long']], 'Type3InputBuffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_182b' : [ 0x8, { + '__unnamed_1828' : [ 0x8, { 'SecurityInformation' : [ 0x0, ['unsigned long']], 'Length' : [ 0x4, ['unsigned long']], } ], - '__unnamed_182d' : [ 0x8, { + '__unnamed_182a' : [ 0x8, { 'SecurityInformation' : [ 0x0, ['unsigned long']], 'SecurityDescriptor' : [ 0x4, ['pointer', ['void']]], } ], - '__unnamed_182f' : [ 0x8, { + '__unnamed_182c' : [ 0x8, { 'Vpb' : [ 0x0, ['pointer', ['_VPB']]], 'DeviceObject' : [ 0x4, ['pointer', ['_DEVICE_OBJECT']]], } ], - '__unnamed_1833' : [ 0x4, { + '__unnamed_1830' : [ 0x4, { 'Srb' : [ 0x0, ['pointer', ['_SCSI_REQUEST_BLOCK']]], } ], - '__unnamed_1837' : [ 0x10, { + '__unnamed_1834' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'StartSid' : [ 0x4, ['pointer', ['void']]], 'SidList' : [ 0x8, ['pointer', ['_FILE_GET_QUOTA_INFORMATION']]], 'SidListLength' : [ 0xc, ['unsigned long']], } ], - '__unnamed_183b' : [ 0x4, { + '__unnamed_1838' : [ 0x4, { 'Type' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusRelations', 1: 'EjectionRelations', 2: 'PowerRelations', 3: 'RemovalRelations', 4: 'TargetDeviceRelation', 5: 'SingleBusRelations'})]], } ], - '__unnamed_183d' : [ 0x10, { + '__unnamed_183a' : [ 0x10, { 'InterfaceType' : [ 0x0, ['pointer', ['_GUID']]], 'Size' : [ 0x4, ['unsigned short']], 'Version' : [ 0x6, ['unsigned short']], 'Interface' : [ 0x8, ['pointer', ['_INTERFACE']]], 'InterfaceSpecificData' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1841' : [ 0x4, { + '__unnamed_183e' : [ 0x4, { 'Capabilities' : [ 0x0, ['pointer', ['_DEVICE_CAPABILITIES']]], } ], - '__unnamed_1843' : [ 0x4, { + '__unnamed_1840' : [ 0x4, { 'IoResourceRequirementList' : [ 0x0, ['pointer', ['_IO_RESOURCE_REQUIREMENTS_LIST']]], } ], - '__unnamed_1845' : [ 0x10, { + '__unnamed_1842' : [ 0x10, { 'WhichSpace' : [ 0x0, ['unsigned long']], 'Buffer' : [ 0x4, ['pointer', ['void']]], 'Offset' : [ 0x8, ['unsigned long']], 'Length' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1847' : [ 0x1, { + '__unnamed_1844' : [ 0x1, { 'Lock' : [ 0x0, ['unsigned char']], } ], - '__unnamed_184b' : [ 0x4, { + '__unnamed_1848' : [ 0x4, { 'IdType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'BusQueryDeviceID', 1: 'BusQueryHardwareIDs', 2: 'BusQueryCompatibleIDs', 3: 'BusQueryInstanceID', 4: 'BusQueryDeviceSerialNumber'})]], } ], - '__unnamed_184f' : [ 0x8, { + '__unnamed_184c' : [ 0x8, { 'DeviceTextType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceTextDescription', 1: 'DeviceTextLocationInformation'})]], 'LocaleId' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1853' : [ 0x8, { + '__unnamed_1850' : [ 0x8, { 'InPath' : [ 0x0, ['unsigned char']], 'Reserved' : [ 0x1, ['array', 3, ['unsigned char']]], 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'DeviceUsageTypeUndefined', 1: 'DeviceUsageTypePaging', 2: 'DeviceUsageTypeHibernation', 3: 'DeviceUsageTypeDumpFile'})]], } ], - '__unnamed_1855' : [ 0x4, { + '__unnamed_1852' : [ 0x4, { 'PowerState' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PowerSystemUnspecified', 1: 'PowerSystemWorking', 2: 'PowerSystemSleeping1', 3: 'PowerSystemSleeping2', 4: 'PowerSystemSleeping3', 5: 'PowerSystemHibernate', 6: 'PowerSystemShutdown', 7: 'PowerSystemMaximum'})]], } ], - '__unnamed_1859' : [ 0x4, { + '__unnamed_1856' : [ 0x4, { 'PowerSequence' : [ 0x0, ['pointer', ['_POWER_SEQUENCE']]], } ], - '__unnamed_185d' : [ 0x10, { + '__unnamed_185a' : [ 0x10, { 'SystemContext' : [ 0x0, ['unsigned long']], 'Type' : [ 0x4, ['Enumeration', dict(target = 'long', choices = {0: 'SystemPowerState', 1: 'DevicePowerState'})]], 'State' : [ 0x8, ['_POWER_STATE']], 'ShutdownType' : [ 0xc, ['Enumeration', dict(target = 'long', choices = {0: 'PowerActionNone', 1: 'PowerActionReserved', 2: 'PowerActionSleep', 3: 'PowerActionHibernate', 4: 'PowerActionShutdown', 5: 'PowerActionShutdownReset', 6: 'PowerActionShutdownOff', 7: 'PowerActionWarmEject'})]], } ], - '__unnamed_185f' : [ 0x8, { + '__unnamed_185c' : [ 0x8, { 'AllocatedResources' : [ 0x0, ['pointer', ['_CM_RESOURCE_LIST']]], 'AllocatedResourcesTranslated' : [ 0x4, ['pointer', ['_CM_RESOURCE_LIST']]], } ], - '__unnamed_1861' : [ 0x10, { + '__unnamed_185e' : [ 0x10, { 'ProviderId' : [ 0x0, ['unsigned long']], 'DataPath' : [ 0x4, ['pointer', ['void']]], 'BufferSize' : [ 0x8, ['unsigned long']], 'Buffer' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1863' : [ 0x10, { + '__unnamed_1860' : [ 0x10, { 'Argument1' : [ 0x0, ['pointer', ['void']]], 'Argument2' : [ 0x4, ['pointer', ['void']]], 'Argument3' : [ 0x8, ['pointer', ['void']]], 'Argument4' : [ 0xc, ['pointer', ['void']]], } ], - '__unnamed_1865' : [ 0x10, { - 'Create' : [ 0x0, ['__unnamed_1806']], - 'CreatePipe' : [ 0x0, ['__unnamed_180a']], - 'CreateMailslot' : [ 0x0, ['__unnamed_180e']], - 'Read' : [ 0x0, ['__unnamed_1810']], - 'Write' : [ 0x0, ['__unnamed_1810']], - 'QueryDirectory' : [ 0x0, ['__unnamed_1815']], - 'NotifyDirectory' : [ 0x0, ['__unnamed_1817']], - 'QueryFile' : [ 0x0, ['__unnamed_1819']], - 'SetFile' : [ 0x0, ['__unnamed_181b']], - 'QueryEa' : [ 0x0, ['__unnamed_181d']], - 'SetEa' : [ 0x0, ['__unnamed_181f']], - 'QueryVolume' : [ 0x0, ['__unnamed_1823']], - 'SetVolume' : [ 0x0, ['__unnamed_1823']], - 'FileSystemControl' : [ 0x0, ['__unnamed_1825']], - 'LockControl' : [ 0x0, ['__unnamed_1827']], - 'DeviceIoControl' : [ 0x0, ['__unnamed_1829']], - 'QuerySecurity' : [ 0x0, ['__unnamed_182b']], - 'SetSecurity' : [ 0x0, ['__unnamed_182d']], - 'MountVolume' : [ 0x0, ['__unnamed_182f']], - 'VerifyVolume' : [ 0x0, ['__unnamed_182f']], - 'Scsi' : [ 0x0, ['__unnamed_1833']], - 'QueryQuota' : [ 0x0, ['__unnamed_1837']], - 'SetQuota' : [ 0x0, ['__unnamed_181f']], - 'QueryDeviceRelations' : [ 0x0, ['__unnamed_183b']], - 'QueryInterface' : [ 0x0, ['__unnamed_183d']], - 'DeviceCapabilities' : [ 0x0, ['__unnamed_1841']], - 'FilterResourceRequirements' : [ 0x0, ['__unnamed_1843']], - 'ReadWriteConfig' : [ 0x0, ['__unnamed_1845']], - 'SetLock' : [ 0x0, ['__unnamed_1847']], - 'QueryId' : [ 0x0, ['__unnamed_184b']], - 'QueryDeviceText' : [ 0x0, ['__unnamed_184f']], - 'UsageNotification' : [ 0x0, ['__unnamed_1853']], - 'WaitWake' : [ 0x0, ['__unnamed_1855']], - 'PowerSequence' : [ 0x0, ['__unnamed_1859']], - 'Power' : [ 0x0, ['__unnamed_185d']], - 'StartDevice' : [ 0x0, ['__unnamed_185f']], - 'WMI' : [ 0x0, ['__unnamed_1861']], - 'Others' : [ 0x0, ['__unnamed_1863']], + '__unnamed_1862' : [ 0x10, { + 'Create' : [ 0x0, ['__unnamed_1803']], + 'CreatePipe' : [ 0x0, ['__unnamed_1807']], + 'CreateMailslot' : [ 0x0, ['__unnamed_180b']], + 'Read' : [ 0x0, ['__unnamed_180d']], + 'Write' : [ 0x0, ['__unnamed_180d']], + 'QueryDirectory' : [ 0x0, ['__unnamed_1812']], + 'NotifyDirectory' : [ 0x0, ['__unnamed_1814']], + 'QueryFile' : [ 0x0, ['__unnamed_1816']], + 'SetFile' : [ 0x0, ['__unnamed_1818']], + 'QueryEa' : [ 0x0, ['__unnamed_181a']], + 'SetEa' : [ 0x0, ['__unnamed_181c']], + 'QueryVolume' : [ 0x0, ['__unnamed_1820']], + 'SetVolume' : [ 0x0, ['__unnamed_1820']], + 'FileSystemControl' : [ 0x0, ['__unnamed_1822']], + 'LockControl' : [ 0x0, ['__unnamed_1824']], + 'DeviceIoControl' : [ 0x0, ['__unnamed_1826']], + 'QuerySecurity' : [ 0x0, ['__unnamed_1828']], + 'SetSecurity' : [ 0x0, ['__unnamed_182a']], + 'MountVolume' : [ 0x0, ['__unnamed_182c']], + 'VerifyVolume' : [ 0x0, ['__unnamed_182c']], + 'Scsi' : [ 0x0, ['__unnamed_1830']], + 'QueryQuota' : [ 0x0, ['__unnamed_1834']], + 'SetQuota' : [ 0x0, ['__unnamed_181c']], + 'QueryDeviceRelations' : [ 0x0, ['__unnamed_1838']], + 'QueryInterface' : [ 0x0, ['__unnamed_183a']], + 'DeviceCapabilities' : [ 0x0, ['__unnamed_183e']], + 'FilterResourceRequirements' : [ 0x0, ['__unnamed_1840']], + 'ReadWriteConfig' : [ 0x0, ['__unnamed_1842']], + 'SetLock' : [ 0x0, ['__unnamed_1844']], + 'QueryId' : [ 0x0, ['__unnamed_1848']], + 'QueryDeviceText' : [ 0x0, ['__unnamed_184c']], + 'UsageNotification' : [ 0x0, ['__unnamed_1850']], + 'WaitWake' : [ 0x0, ['__unnamed_1852']], + 'PowerSequence' : [ 0x0, ['__unnamed_1856']], + 'Power' : [ 0x0, ['__unnamed_185a']], + 'StartDevice' : [ 0x0, ['__unnamed_185c']], + 'WMI' : [ 0x0, ['__unnamed_185e']], + 'Others' : [ 0x0, ['__unnamed_1860']], } ], '_IO_STACK_LOCATION' : [ 0x24, { 'MajorFunction' : [ 0x0, ['unsigned char']], 'MinorFunction' : [ 0x1, ['unsigned char']], 'Flags' : [ 0x2, ['unsigned char']], 'Control' : [ 0x3, ['unsigned char']], - 'Parameters' : [ 0x4, ['__unnamed_1865']], + 'Parameters' : [ 0x4, ['__unnamed_1862']], 'DeviceObject' : [ 0x14, ['pointer', ['_DEVICE_OBJECT']]], 'FileObject' : [ 0x18, ['pointer', ['_FILE_OBJECT']]], 'CompletionRoutine' : [ 0x1c, ['pointer', ['void']]], 'Context' : [ 0x20, ['pointer', ['void']]], } ], - '__unnamed_186c' : [ 0x18, { + '__unnamed_1869' : [ 0x18, { 'Length' : [ 0x0, ['unsigned long']], 'Alignment' : [ 0x4, ['unsigned long']], 'MinimumAddress' : [ 0x8, ['_LARGE_INTEGER']], 'MaximumAddress' : [ 0x10, ['_LARGE_INTEGER']], } ], - '__unnamed_186e' : [ 0x8, { + '__unnamed_186b' : [ 0x8, { 'MinimumVector' : [ 0x0, ['unsigned long']], 'MaximumVector' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1870' : [ 0x8, { + '__unnamed_186d' : [ 0x8, { 'MinimumChannel' : [ 0x0, ['unsigned long']], 'MaximumChannel' : [ 0x4, ['unsigned long']], } ], - '__unnamed_1872' : [ 0x10, { + '__unnamed_186f' : [ 0x10, { 'Length' : [ 0x0, ['unsigned long']], 'MinBusNumber' : [ 0x4, ['unsigned long']], 'MaxBusNumber' : [ 0x8, ['unsigned long']], 'Reserved' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1874' : [ 0xc, { + '__unnamed_1871' : [ 0xc, { 'Priority' : [ 0x0, ['unsigned long']], 'Reserved1' : [ 0x4, ['unsigned long']], 'Reserved2' : [ 0x8, ['unsigned long']], } ], - '__unnamed_1876' : [ 0x18, { - 'Port' : [ 0x0, ['__unnamed_186c']], - 'Memory' : [ 0x0, ['__unnamed_186c']], - 'Interrupt' : [ 0x0, ['__unnamed_186e']], - 'Dma' : [ 0x0, ['__unnamed_1870']], - 'Generic' : [ 0x0, ['__unnamed_186c']], - 'DevicePrivate' : [ 0x0, ['__unnamed_155b']], - 'BusNumber' : [ 0x0, ['__unnamed_1872']], - 'ConfigData' : [ 0x0, ['__unnamed_1874']], + '__unnamed_1873' : [ 0x18, { + 'Port' : [ 0x0, ['__unnamed_1869']], + 'Memory' : [ 0x0, ['__unnamed_1869']], + 'Interrupt' : [ 0x0, ['__unnamed_186b']], + 'Dma' : [ 0x0, ['__unnamed_186d']], + 'Generic' : [ 0x0, ['__unnamed_1869']], + 'DevicePrivate' : [ 0x0, ['__unnamed_1557']], + 'BusNumber' : [ 0x0, ['__unnamed_186f']], + 'ConfigData' : [ 0x0, ['__unnamed_1871']], } ], '_IO_RESOURCE_DESCRIPTOR' : [ 0x20, { 'Option' : [ 0x0, ['unsigned char']], @@ -4618,7 +4618,7 @@ nt_types = { 'Spare1' : [ 0x3, ['unsigned char']], 'Flags' : [ 0x4, ['unsigned short']], 'Spare2' : [ 0x6, ['unsigned short']], - 'u' : [ 0x8, ['__unnamed_1876']], + 'u' : [ 0x8, ['__unnamed_1873']], } ], '_LUID_AND_ATTRIBUTES' : [ 0xc, { 'Luid' : [ 0x0, ['_LUID']], @@ -4637,25 +4637,25 @@ nt_types = { 'CallerAddress' : [ 0x14, ['array', 10, ['pointer', ['void']]]], 'KeyBodyList' : [ 0x3c, ['_LIST_ENTRY']], } ], - '__unnamed_1887' : [ 0x4, { + '__unnamed_1884' : [ 0x4, { 'DataLength' : [ 0x0, ['short']], 'TotalLength' : [ 0x2, ['short']], } ], - '__unnamed_1889' : [ 0x4, { - 's1' : [ 0x0, ['__unnamed_1887']], + '__unnamed_1886' : [ 0x4, { + 's1' : [ 0x0, ['__unnamed_1884']], 'Length' : [ 0x0, ['unsigned long']], } ], - '__unnamed_188b' : [ 0x4, { + '__unnamed_1888' : [ 0x4, { 'Type' : [ 0x0, ['short']], 'DataInfoOffset' : [ 0x2, ['short']], } ], - '__unnamed_188d' : [ 0x4, { - 's2' : [ 0x0, ['__unnamed_188b']], + '__unnamed_188a' : [ 0x4, { + 's2' : [ 0x0, ['__unnamed_1888']], 'ZeroInit' : [ 0x0, ['unsigned long']], } ], '_PORT_MESSAGE' : [ 0x18, { - 'u1' : [ 0x0, ['__unnamed_1889']], - 'u2' : [ 0x4, ['__unnamed_188d']], + 'u1' : [ 0x0, ['__unnamed_1886']], + 'u2' : [ 0x4, ['__unnamed_188a']], 'ClientId' : [ 0x8, ['_CLIENT_ID']], 'DoNotUseThisField' : [ 0x8, ['double']], 'MessageId' : [ 0x10, ['unsigned long']], @@ -4810,17 +4810,17 @@ nt_types = { 'Parameter3' : [ 0xc, ['unsigned long']], 'Parameter4' : [ 0x10, ['unsigned long']], } ], - '__unnamed_18cc' : [ 0x4, { - 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5)]], - 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8)]], - 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32)]], + '__unnamed_18c9' : [ 0x4, { + 'DeviceNumber' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 5, native_type='unsigned long')]], + 'FunctionNumber' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 8, native_type='unsigned long')]], + 'Reserved' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 32, native_type='unsigned long')]], } ], - '__unnamed_18ce' : [ 0x4, { - 'bits' : [ 0x0, ['__unnamed_18cc']], + '__unnamed_18cb' : [ 0x4, { + 'bits' : [ 0x0, ['__unnamed_18c9']], 'AsULONG' : [ 0x0, ['unsigned long']], } ], '_PCI_SLOT_NUMBER' : [ 0x4, { - 'u' : [ 0x0, ['__unnamed_18ce']], + 'u' : [ 0x0, ['__unnamed_18cb']], } ], '_Wx86ThreadState' : [ 0xc, { 'CallBx86Eip' : [ 0x0, ['pointer', ['unsigned long']]], @@ -4841,9 +4841,9 @@ nt_types = { 'PostList' : [ 0x8, ['_LIST_ENTRY']], 'KeyControlBlock' : [ 0x10, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], 'KeyBody' : [ 0x14, ['pointer', ['_CM_KEY_BODY']]], - 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30)]], - 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31)]], - 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32)]], + 'Filter' : [ 0x18, ['BitField', dict(start_bit = 0, end_bit = 30, native_type='unsigned long')]], + 'WatchTree' : [ 0x18, ['BitField', dict(start_bit = 30, end_bit = 31, native_type='unsigned long')]], + 'NotifyPending' : [ 0x18, ['BitField', dict(start_bit = 31, end_bit = 32, native_type='unsigned long')]], 'SubjectContext' : [ 0x1c, ['_SECURITY_SUBJECT_CONTEXT']], } ], '_SID' : [ 0xc, { @@ -4889,46 +4889,46 @@ nt_types = { 'Dacl' : [ 0x10, ['unsigned long']], } ], '_PM_SUPPORT' : [ 0x1, { - 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8)]], + 'Rsvd2' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'D1' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'D2' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'PMED0' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'PMED1' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'PMED2' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'PMED3Hot' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned char')]], + 'PMED3Cold' : [ 0x0, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned char')]], } ], - '__unnamed_18f4' : [ 0xc, { + '__unnamed_18f1' : [ 0xc, { 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], 'AllocateFromCount' : [ 0x4, ['unsigned long']], 'AllocateFrom' : [ 0x8, ['pointer', ['_CM_PARTIAL_RESOURCE_DESCRIPTOR']]], } ], - '__unnamed_18f6' : [ 0x4, { + '__unnamed_18f3' : [ 0x4, { 'ArbitrationList' : [ 0x0, ['pointer', ['_LIST_ENTRY']]], } ], - '__unnamed_18fa' : [ 0x4, { + '__unnamed_18f7' : [ 0x4, { 'AllocatedResources' : [ 0x0, ['pointer', ['pointer', ['_CM_PARTIAL_RESOURCE_LIST']]]], } ], - '__unnamed_18fc' : [ 0x10, { + '__unnamed_18f9' : [ 0x10, { 'PhysicalDeviceObject' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], 'ConflictingResource' : [ 0x4, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], 'ConflictCount' : [ 0x8, ['pointer', ['unsigned long']]], 'Conflicts' : [ 0xc, ['pointer', ['pointer', ['_ARBITER_CONFLICT_INFO']]]], } ], - '__unnamed_18fe' : [ 0x4, { + '__unnamed_18fb' : [ 0x4, { 'ReserveDevice' : [ 0x0, ['pointer', ['_DEVICE_OBJECT']]], } ], - '__unnamed_1900' : [ 0x10, { - 'TestAllocation' : [ 0x0, ['__unnamed_18f4']], - 'RetestAllocation' : [ 0x0, ['__unnamed_18f4']], - 'BootAllocation' : [ 0x0, ['__unnamed_18f6']], - 'QueryAllocatedResources' : [ 0x0, ['__unnamed_18fa']], - 'QueryConflict' : [ 0x0, ['__unnamed_18fc']], - 'QueryArbitrate' : [ 0x0, ['__unnamed_18f6']], - 'AddReserved' : [ 0x0, ['__unnamed_18fe']], + '__unnamed_18fd' : [ 0x10, { + 'TestAllocation' : [ 0x0, ['__unnamed_18f1']], + 'RetestAllocation' : [ 0x0, ['__unnamed_18f1']], + 'BootAllocation' : [ 0x0, ['__unnamed_18f3']], + 'QueryAllocatedResources' : [ 0x0, ['__unnamed_18f7']], + 'QueryConflict' : [ 0x0, ['__unnamed_18f9']], + 'QueryArbitrate' : [ 0x0, ['__unnamed_18f3']], + 'AddReserved' : [ 0x0, ['__unnamed_18fb']], } ], '_ARBITER_PARAMETERS' : [ 0x10, { - 'Parameters' : [ 0x0, ['__unnamed_1900']], + 'Parameters' : [ 0x0, ['__unnamed_18fd']], } ], '_SECURITY_TOKEN_AUDIT_DATA' : [ 0xc, { 'Length' : [ 0x0, ['unsigned long']], @@ -5035,25 +5035,25 @@ nt_types = { '_DEVICE_CAPABILITIES' : [ 0x40, { 'Size' : [ 0x0, ['unsigned short']], 'Version' : [ 0x2, ['unsigned short']], - 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7)]], - 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8)]], - 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9)]], - 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10)]], - 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11)]], - 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12)]], - 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13)]], - 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14)]], - 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15)]], - 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16)]], - 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17)]], - 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18)]], - 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32)]], + 'DeviceD1' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned long')]], + 'DeviceD2' : [ 0x4, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned long')]], + 'LockSupported' : [ 0x4, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned long')]], + 'EjectSupported' : [ 0x4, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned long')]], + 'Removable' : [ 0x4, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned long')]], + 'DockDevice' : [ 0x4, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned long')]], + 'UniqueID' : [ 0x4, ['BitField', dict(start_bit = 6, end_bit = 7, native_type='unsigned long')]], + 'SilentInstall' : [ 0x4, ['BitField', dict(start_bit = 7, end_bit = 8, native_type='unsigned long')]], + 'RawDeviceOK' : [ 0x4, ['BitField', dict(start_bit = 8, end_bit = 9, native_type='unsigned long')]], + 'SurpriseRemovalOK' : [ 0x4, ['BitField', dict(start_bit = 9, end_bit = 10, native_type='unsigned long')]], + 'WakeFromD0' : [ 0x4, ['BitField', dict(start_bit = 10, end_bit = 11, native_type='unsigned long')]], + 'WakeFromD1' : [ 0x4, ['BitField', dict(start_bit = 11, end_bit = 12, native_type='unsigned long')]], + 'WakeFromD2' : [ 0x4, ['BitField', dict(start_bit = 12, end_bit = 13, native_type='unsigned long')]], + 'WakeFromD3' : [ 0x4, ['BitField', dict(start_bit = 13, end_bit = 14, native_type='unsigned long')]], + 'HardwareDisabled' : [ 0x4, ['BitField', dict(start_bit = 14, end_bit = 15, native_type='unsigned long')]], + 'NonDynamic' : [ 0x4, ['BitField', dict(start_bit = 15, end_bit = 16, native_type='unsigned long')]], + 'WarmEjectSupported' : [ 0x4, ['BitField', dict(start_bit = 16, end_bit = 17, native_type='unsigned long')]], + 'NoDisplayInUI' : [ 0x4, ['BitField', dict(start_bit = 17, end_bit = 18, native_type='unsigned long')]], + 'Reserved' : [ 0x4, ['BitField', dict(start_bit = 18, end_bit = 32, native_type='unsigned long')]], 'Address' : [ 0x8, ['unsigned long']], 'UINumber' : [ 0xc, ['unsigned long']], 'DeviceState' : [ 0x10, ['array', -28, ['Enumeration', dict(target = 'long', choices = {0: 'PowerDeviceUnspecified', 1: 'PowerDeviceD0', 2: 'PowerDeviceD1', 3: 'PowerDeviceD2', 4: 'PowerDeviceD3', 5: 'PowerDeviceMaximum'})]]], @@ -5087,43 +5087,43 @@ nt_types = { 'PolicyOverlay' : [ 0x0, ['_SEP_AUDIT_POLICY_OVERLAY']], 'Overlay' : [ 0x0, ['unsigned long long']], } ], - '__unnamed_192f' : [ 0x14, { + '__unnamed_192c' : [ 0x14, { 'ClassGuid' : [ 0x0, ['_GUID']], 'SymbolicLinkName' : [ 0x10, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1931' : [ 0x2, { + '__unnamed_192e' : [ 0x2, { 'DeviceIds' : [ 0x0, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1933' : [ 0x2, { + '__unnamed_1930' : [ 0x2, { 'DeviceId' : [ 0x0, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1935' : [ 0x8, { + '__unnamed_1932' : [ 0x8, { 'NotificationStructure' : [ 0x0, ['pointer', ['void']]], 'DeviceIds' : [ 0x4, ['array', 1, ['unsigned short']]], } ], - '__unnamed_1937' : [ 0x4, { + '__unnamed_1934' : [ 0x4, { 'Notification' : [ 0x0, ['pointer', ['void']]], } ], - '__unnamed_1939' : [ 0x8, { + '__unnamed_1936' : [ 0x8, { 'NotificationCode' : [ 0x0, ['unsigned long']], 'NotificationData' : [ 0x4, ['unsigned long']], } ], - '__unnamed_193b' : [ 0x8, { + '__unnamed_1938' : [ 0x8, { 'VetoType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'PNP_VetoTypeUnknown', 1: 'PNP_VetoLegacyDevice', 2: 'PNP_VetoPendingClose', 3: 'PNP_VetoWindowsApp', 4: 'PNP_VetoWindowsService', 5: 'PNP_VetoOutstandingOpen', 6: 'PNP_VetoDevice', 7: 'PNP_VetoDriver', 8: 'PNP_VetoIllegalDeviceRequest', 9: 'PNP_VetoInsufficientPower', 10: 'PNP_VetoNonDisableable', 11: 'PNP_VetoLegacyDriver', 12: 'PNP_VetoInsufficientRights'})]], 'DeviceIdVetoNameBuffer' : [ 0x4, ['array', 1, ['unsigned short']]], } ], - '__unnamed_193d' : [ 0x10, { + '__unnamed_193a' : [ 0x10, { 'BlockedDriverGuid' : [ 0x0, ['_GUID']], } ], - '__unnamed_193f' : [ 0x14, { - 'DeviceClass' : [ 0x0, ['__unnamed_192f']], - 'TargetDevice' : [ 0x0, ['__unnamed_1931']], - 'InstallDevice' : [ 0x0, ['__unnamed_1933']], - 'CustomNotification' : [ 0x0, ['__unnamed_1935']], - 'ProfileNotification' : [ 0x0, ['__unnamed_1937']], - 'PowerNotification' : [ 0x0, ['__unnamed_1939']], - 'VetoNotification' : [ 0x0, ['__unnamed_193b']], - 'BlockedDriverNotification' : [ 0x0, ['__unnamed_193d']], + '__unnamed_193c' : [ 0x14, { + 'DeviceClass' : [ 0x0, ['__unnamed_192c']], + 'TargetDevice' : [ 0x0, ['__unnamed_192e']], + 'InstallDevice' : [ 0x0, ['__unnamed_1930']], + 'CustomNotification' : [ 0x0, ['__unnamed_1932']], + 'ProfileNotification' : [ 0x0, ['__unnamed_1934']], + 'PowerNotification' : [ 0x0, ['__unnamed_1936']], + 'VetoNotification' : [ 0x0, ['__unnamed_1938']], + 'BlockedDriverNotification' : [ 0x0, ['__unnamed_193a']], } ], '_PLUGPLAY_EVENT_BLOCK' : [ 0x38, { 'EventGuid' : [ 0x0, ['_GUID']], @@ -5132,39 +5132,39 @@ nt_types = { 'Flags' : [ 0x18, ['unsigned long']], 'TotalSize' : [ 0x1c, ['unsigned long']], 'DeviceObject' : [ 0x20, ['pointer', ['void']]], - 'u' : [ 0x24, ['__unnamed_193f']], + 'u' : [ 0x24, ['__unnamed_193c']], } ], '_CACHED_CHILD_LIST' : [ 0x8, { 'Count' : [ 0x0, ['unsigned long']], 'ValueList' : [ 0x4, ['unsigned long']], 'RealKcb' : [ 0x4, ['pointer', ['_CM_KEY_CONTROL_BLOCK']]], } ], - '__unnamed_1945' : [ 0x10, { + '__unnamed_1942' : [ 0x10, { 'PageNo' : [ 0x0, ['unsigned long']], 'StartPage' : [ 0x4, ['unsigned long']], 'EndPage' : [ 0x8, ['unsigned long']], 'CheckSum' : [ 0xc, ['unsigned long']], } ], - '__unnamed_1947' : [ 0x10, { + '__unnamed_1944' : [ 0x10, { 'Next' : [ 0x0, ['pointer', ['_PO_MEMORY_RANGE_ARRAY']]], 'NextTable' : [ 0x4, ['unsigned long']], 'CheckSum' : [ 0x8, ['unsigned long']], 'EntryCount' : [ 0xc, ['unsigned long']], } ], '_PO_MEMORY_RANGE_ARRAY' : [ 0x10, { - 'Range' : [ 0x0, ['__unnamed_1945']], - 'Link' : [ 0x0, ['__unnamed_1947']], + 'Range' : [ 0x0, ['__unnamed_1942']], + 'Link' : [ 0x0, ['__unnamed_1944']], } ], - '__unnamed_1959' : [ 0x8, { + '__unnamed_1956' : [ 0x8, { 'Signature' : [ 0x0, ['unsigned long']], 'CheckSum' : [ 0x4, ['unsigned long']], } ], - '__unnamed_195b' : [ 0x10, { + '__unnamed_1958' : [ 0x10, { 'DiskId' : [ 0x0, ['_GUID']], } ], - '__unnamed_195d' : [ 0x10, { - 'Mbr' : [ 0x0, ['__unnamed_1959']], - 'Gpt' : [ 0x0, ['__unnamed_195b']], + '__unnamed_195a' : [ 0x10, { + 'Mbr' : [ 0x0, ['__unnamed_1956']], + 'Gpt' : [ 0x0, ['__unnamed_1958']], } ], '_DUMP_INITIALIZATION_CONTEXT' : [ 0x70, { 'Length' : [ 0x0, ['unsigned long']], @@ -5185,20 +5185,20 @@ nt_types = { 'TargetAddress' : [ 0x50, ['pointer', ['void']]], 'WritePendingRoutine' : [ 0x54, ['pointer', ['void']]], 'PartitionStyle' : [ 0x58, ['unsigned long']], - 'DiskInfo' : [ 0x5c, ['__unnamed_195d']], + 'DiskInfo' : [ 0x5c, ['__unnamed_195a']], } ], '_IO_CLIENT_EXTENSION' : [ 0x8, { 'NextExtension' : [ 0x0, ['pointer', ['_IO_CLIENT_EXTENSION']]], 'ClientIdentificationAddress' : [ 0x4, ['pointer', ['void']]], } ], '_KEXECUTE_OPTIONS' : [ 0x1, { - 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1)]], - 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2)]], - 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3)]], - 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4)]], - 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5)]], - 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6)]], - 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8)]], + 'ExecuteDisable' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 1, native_type='unsigned char')]], + 'ExecuteEnable' : [ 0x0, ['BitField', dict(start_bit = 1, end_bit = 2, native_type='unsigned char')]], + 'DisableThunkEmulation' : [ 0x0, ['BitField', dict(start_bit = 2, end_bit = 3, native_type='unsigned char')]], + 'Permanent' : [ 0x0, ['BitField', dict(start_bit = 3, end_bit = 4, native_type='unsigned char')]], + 'ExecuteDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 5, native_type='unsigned char')]], + 'ImageDispatchEnable' : [ 0x0, ['BitField', dict(start_bit = 5, end_bit = 6, native_type='unsigned char')]], + 'Spare' : [ 0x0, ['BitField', dict(start_bit = 6, end_bit = 8, native_type='unsigned char')]], } ], '_CM_NAME_HASH' : [ 0xc, { 'ConvKey' : [ 0x0, ['unsigned long']], @@ -5221,8 +5221,8 @@ nt_types = { 'WorkSpace' : [ 0x34, ['unsigned long']], } ], '_SEP_AUDIT_POLICY_OVERLAY' : [ 0x8, { - 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36)]], - 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37)]], + 'PolicyBits' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 36, native_type='unsigned long long')]], + 'SetBit' : [ 0x0, ['BitField', dict(start_bit = 36, end_bit = 37, native_type='unsigned long long')]], } ], '_PCI_HEADER_TYPE_0' : [ 0x30, { 'BaseAddresses' : [ 0x0, ['array', 6, ['unsigned long']]], @@ -5296,7 +5296,7 @@ nt_types = { 'ReadyS0' : [ 0x38, ['_LIST_ENTRY']], 'WaitS0' : [ 0x40, ['_LIST_ENTRY']], } ], - '__unnamed_1992' : [ 0x8, { + '__unnamed_198f' : [ 0x8, { 'Base' : [ 0x0, ['unsigned long']], 'Limit' : [ 0x4, ['unsigned long']], } ], @@ -5309,21 +5309,21 @@ nt_types = { 'SecondaryBus' : [ 0x9, ['unsigned char']], 'SubordinateBus' : [ 0xa, ['unsigned char']], 'SecondaryLatency' : [ 0xb, ['unsigned char']], - 'Range' : [ 0xc, ['array', 4, ['__unnamed_1992']]], + 'Range' : [ 0xc, ['array', 4, ['__unnamed_198f']]], 'InterruptLine' : [ 0x2c, ['unsigned char']], 'InterruptPin' : [ 0x2d, ['unsigned char']], 'BridgeControl' : [ 0x2e, ['unsigned short']], } ], '_SEP_AUDIT_POLICY_CATEGORIES' : [ 0x8, { - 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4)]], - 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8)]], - 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12)]], - 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16)]], - 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28)]], - 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32)]], - 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4)]], + 'System' : [ 0x0, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], + 'Logon' : [ 0x0, ['BitField', dict(start_bit = 4, end_bit = 8, native_type='unsigned long')]], + 'ObjectAccess' : [ 0x0, ['BitField', dict(start_bit = 8, end_bit = 12, native_type='unsigned long')]], + 'PrivilegeUse' : [ 0x0, ['BitField', dict(start_bit = 12, end_bit = 16, native_type='unsigned long')]], + 'DetailedTracking' : [ 0x0, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'PolicyChange' : [ 0x0, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'AccountManagement' : [ 0x0, ['BitField', dict(start_bit = 24, end_bit = 28, native_type='unsigned long')]], + 'DirectoryServiceAccess' : [ 0x0, ['BitField', dict(start_bit = 28, end_bit = 32, native_type='unsigned long')]], + 'AccountLogon' : [ 0x4, ['BitField', dict(start_bit = 0, end_bit = 4, native_type='unsigned long')]], } ], '_CM_KEY_VALUE' : [ 0x18, { 'Signature' : [ 0x0, ['unsigned short']], @@ -5466,10 +5466,10 @@ nt_types = { 'ChildHiveReference' : [ 0x1c, ['_CM_KEY_REFERENCE']], 'Security' : [ 0x2c, ['unsigned long']], 'Class' : [ 0x30, ['unsigned long']], - 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16)]], - 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20)]], - 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24)]], - 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32)]], + 'MaxNameLen' : [ 0x34, ['BitField', dict(start_bit = 0, end_bit = 16, native_type='unsigned long')]], + 'UserFlags' : [ 0x34, ['BitField', dict(start_bit = 16, end_bit = 20, native_type='unsigned long')]], + 'VirtControlFlags' : [ 0x34, ['BitField', dict(start_bit = 20, end_bit = 24, native_type='unsigned long')]], + 'Debug' : [ 0x34, ['BitField', dict(start_bit = 24, end_bit = 32, native_type='unsigned long')]], 'MaxClassLen' : [ 0x38, ['unsigned long']], 'MaxValueNameLen' : [ 0x3c, ['unsigned long']], 'MaxValueDataLen' : [ 0x40, ['unsigned long']], @@ -5520,18 +5520,18 @@ nt_types = { 'Descriptor' : [ 0x20, ['pointer', ['_IO_RESOURCE_DESCRIPTOR']]], 'Reserved' : [ 0x24, ['array', 3, ['unsigned long']]], } ], - '__unnamed_19d5' : [ 0x8, { + '__unnamed_19d2' : [ 0x8, { 'EndingOffset' : [ 0x0, ['pointer', ['_LARGE_INTEGER']]], 'ResourceToRelease' : [ 0x4, ['pointer', ['pointer', ['_ERESOURCE']]]], } ], - '__unnamed_19d7' : [ 0x4, { + '__unnamed_19d4' : [ 0x4, { 'ResourceToRelease' : [ 0x0, ['pointer', ['_ERESOURCE']]], } ], - '__unnamed_19db' : [ 0x8, { + '__unnamed_19d8' : [ 0x8, { 'SyncType' : [ 0x0, ['Enumeration', dict(target = 'long', choices = {0: 'SyncTypeOther', 1: 'SyncTypeCreateSection'})]], 'PageProtection' : [ 0x4, ['unsigned long']], } ], - '__unnamed_19dd' : [ 0x14, { + '__unnamed_19da' : [ 0x14, { 'Argument1' : [ 0x0, ['pointer', ['void']]], 'Argument2' : [ 0x4, ['pointer', ['void']]], 'Argument3' : [ 0x8, ['pointer', ['void']]], @@ -5539,10 +5539,10 @@ nt_types = { 'Argument5' : [ 0x10, ['pointer', ['void']]], } ], '_FS_FILTER_PARAMETERS' : [ 0x14, { - 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_19d5']], - 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_19d7']], - 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_19db']], - 'Others' : [ 0x0, ['__unnamed_19dd']], + 'AcquireForModifiedPageWriter' : [ 0x0, ['__unnamed_19d2']], + 'ReleaseForModifiedPageWriter' : [ 0x0, ['__unnamed_19d4']], + 'AcquireForSectionSynchronization' : [ 0x0, ['__unnamed_19d8']], + 'Others' : [ 0x0, ['__unnamed_19da']], } ], '_DESCRIPTOR' : [ 0x8, { 'Pad' : [ 0x0, ['unsigned short']],